Vulnerability
Affected software: DirectAdmin versions below 1.58.2
DirectAdmin performs unsafe operations as root on user owned files during owner reset through file manager and can be tricked to chown any file in a system to user, allowing for privilege escalation to root.
When /CMD_FILE_MANAGER/file?action=resetowner&method=recursive
is executed by DirectAdmin, it performs lchown()
without safely iterating over path using openat()
with O_NOFOLLOW
flag and using fchownat()
with AT_SYMLINK_NOFOLLOW
flag. It could be tricked to lchown()
root-owned files if directory above would be swapped to a symlink. Here is the attack vector:
4169489 15:40:34.055387 lstat("/home/ztest/.php/php-mail.log", {st_dev=makedev(253, 0), st_ino=32112882, st_mode=S_IFREG|0660, st_nlink=1, st_uid=1013, st_gid=1000, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2019/08/20-00:1 1:24.096091914, st_mtime=2019/08/20-00:11:24.096091914, st_ctime=2019/08/20-00:11:24.096091914}) = 0
<=== attack vector
14726 4169489 15:40:34.055467 lchown("/home/ztest/.php/php-mail.log", 1013, 1020) = 0
Exploit
No exploit was created for that vulnerability.
Solution
Update DirectAdmin to version 1.58.2 or later.
Timeline
- 2019-08-22 - Vulnerability reported to vendor.
- 2019-08-22 - Response from vendor and fix in pre-release binaries.
- 2019-08-27 - DirectAdmin 1.58.2 released with vulnerability fixed.