CVE-2019-15119 in nps
Summary
by MITRE
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/17/2025
The vulnerability identified as CVE-2019-15119 resides within the cnlh nps application version 0.23.2 and earlier, specifically in the installation process located at lib/install/install.go. This flaw represents a critical permission misconfiguration that allows local users to overwrite essential binary files with malicious content. The installation script employs overly permissive 0777 permissions for the nps binary files, which are installed in critical system directories including /usr/local/bin/nps and /usr/bin/nps. This excessive permission setting creates a significant security risk as it grants read, write, and execute privileges to all users on the system, effectively undermining the principle of least privilege that forms the foundation of secure system design.
The technical implementation of this vulnerability stems from the installation script's failure to properly manage file permissions during the deployment process. When the installer creates or modifies the nps binary files in the specified directories, it assigns world-writable permissions that persist throughout the system lifecycle. This flaw aligns with CWE-732, which addresses improper permission assignment, and represents a direct violation of the security principle that system binaries should only be writable by privileged users or the system itself. The vulnerability enables a local attacker to replace the legitimate nps binary with a malicious version, potentially gaining elevated privileges or executing arbitrary code with the privileges of the nps service account. This type of attack falls under the ATT&CK technique T1068, which describes "Local Privilege Escalation" through the exploitation of weak file permissions.
The operational impact of this vulnerability extends beyond simple file overwrite capabilities, as it creates a persistent backdoor mechanism for local attackers to maintain access to the compromised system. Once an attacker successfully overwrites the nps binary, they can execute code with the privileges of the nps service, potentially leading to complete system compromise. The vulnerability affects any system where the cnlh nps application is installed with default settings, making it particularly dangerous in multi-user environments where local access is common. The risk is exacerbated because the nps application itself may be running with elevated privileges, providing attackers with a direct path to privilege escalation. Additionally, the widespread use of such installation scripts without proper permission management demonstrates a broader industry issue with secure coding practices and configuration management.
Mitigation strategies for CVE-2019-15119 should focus on immediate remediation through proper permission management during installation. System administrators must ensure that the installation script assigns appropriate permissions to the nps binary files, typically using 0755 or 0644 permissions for executables, and only grant write access to the system administrator or service account. The recommended approach involves modifying the lib/install/install.go file to explicitly set restrictive permissions after file creation, implementing proper ownership assignments, and ensuring that the installation process follows security best practices for file system management. Organizations should also conduct comprehensive audits of all installed applications to identify similar permission misconfigurations and implement automated security scanning tools to detect such vulnerabilities in the future. This vulnerability serves as a reminder of the critical importance of secure installation processes and proper permission management in preventing local privilege escalation attacks.