Phusion Passenger up to 5.3.1 SpawningKit access control

Summaryinfo

A vulnerability classified as problematic has been found in Phusion Passenger up to 5.3.1. The impacted element is an unknown function of the component SpawningKit. Performing a manipulation results in access control. This vulnerability was named CVE-2018-12028. The attack needs to be approached locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Phusion Passenger up to 5.3.1. It has been classified as problematic. This affects some unknown processing of the component SpawningKit. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on availability. The summary by CVE is:

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.

The bug was discovered 06/13/2018. The weakness was presented 06/17/2018 (Website). It is possible to read the advisory at blog.phusion.nl. This vulnerability is uniquely identified as CVE-2018-12028 since 06/07/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 111225 (GLSA-201807-02 : Passenger: Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Gentoo Local Security Checks and running in the context l.

Upgrading to version 5.3.2 eliminates this vulnerability. A possible mitigation has been published 2 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (111225). See VDB-119641, VDB-119642 and VDB-119644 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Phusion

Name

• Passenger

Version

• 5.3.0
• 5.3.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion