Phusion Passenger up to 5.3.1 nginx race condition

Summaryinfo

A vulnerability classified as critical was found in Phusion Passenger up to 5.3.1. This affects an unknown function of the component nginx. Executing a manipulation can lead to race condition. The identification of this vulnerability is CVE-2018-12029. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Phusion Passenger up to 5.3.1. It has been declared as critical. This vulnerability affects an unknown function of the component nginx. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.

The bug was discovered 06/13/2018. The weakness was shared 06/17/2018 (Website). The advisory is shared for download at blog.phusion.nl. This vulnerability was named CVE-2018-12029 since 06/07/2018. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 110725 (Debian DLA-1399-1 : ruby-passenger security update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context l.

Upgrading to version 5.3.2 eliminates this vulnerability. A possible mitigation has been published 2 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (110725). The entries VDB-119641, VDB-119642 and VDB-119643 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Phusion

Name

• Passenger

Version

• 5.3.0
• 5.3.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion