CVE-2016-10345 in Passenger
Summary
by MITRE
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/04/2025
The vulnerability identified as CVE-2016-10345 affects Phusion Passenger versions prior to 5.1.0, representing a critical privilege escalation flaw that exploits predictable temporary file naming conventions during the nginx module installation process. This vulnerability resides in the passenger-install-nginx-module utility which is commonly used to compile and install the Passenger module for nginx web servers. The flaw stems from the use of a hardcoded temporary filename in the /tmp directory, specifically a predictable pattern that allows local attackers to manipulate the installation process and ultimately elevate their privileges to match those of the passenger user account.
The technical implementation of this vulnerability involves the exploitation of a race condition and predictable file naming mechanism within the installation utility. When passenger-install-nginx-module executes, it creates temporary files using a known filename pattern in the /tmp directory without proper randomization or secure temporary file creation practices. An attacker can leverage this predictability by creating a symbolic link or hard link to the expected temporary file location, effectively intercepting or replacing the temporary file that the installation process expects to create or modify. This allows the attacker to inject malicious code or manipulate the installation process in ways that can result in privilege escalation.
The operational impact of this vulnerability extends beyond simple local privilege escalation, as it can enable attackers to gain elevated system access that may allow them to compromise the entire web server infrastructure. Since Passenger typically runs with elevated privileges to manage web applications and handle system-level operations, successful exploitation can provide attackers with the ability to modify system files, install backdoors, or access sensitive application data. The vulnerability is particularly concerning in multi-tenant hosting environments where Passenger is commonly deployed, as it could allow attackers to compromise other virtual hosts or applications running on the same server.
This vulnerability aligns with CWE-377: Insecure Temporary File and CWE-276: Insecure Permissions for Critical System Resources categories, which highlight the dangers of predictable temporary file handling and inadequate privilege management in system utilities. From an attack framework perspective, this vulnerability maps to the privilege escalation techniques described in the MITRE ATT&CK framework under the Privilege Escalation tactic, specifically targeting the use of insecure temporary file creation as a means to gain elevated system privileges. The attack vector requires local access to the system but can be leveraged to achieve significant operational impact, making it a critical concern for system administrators and security teams responsible for maintaining web server security. Organizations should immediately upgrade to Phusion Passenger version 5.1.0 or later, which implements secure temporary file handling practices and randomizes temporary file names to prevent predictable file manipulation attacks.