CVE-2018-18629

An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allows a local, unprivileged user on Linux to gain root privileges via a Trojan horse binary.

Recent assessments:

bulw4rk at March 26, 2020 6:56pm UTC reported:

Description

The installation of a vulnerable version of Keybase deploys a SUID binary named “keybase-redirector” which calls the “fusermount” binary using a relative path, making the application trust the value of $PATH. This triggers a PATH injection vulnerability which allows local privilege escalation by using a malicious file with its name set to “fusermount”.

Mitigation

The maintainer has released some fixes, so the software must be upgrade to Keybase version 2.8.0-20181023124437 or above.

Affected Systems

All Keybase versions prior to 2.8.0-20181023124437.

PoC

1- We can identify a potential vulnerable installation with the following command, which will help us identify the SUID binary related to Keybase.

find / -perm 4000 2>/dev/null | grep keybase

2- To verify the vulnerability, we check the output of the following command is prior to 2.8.0-20181023124437.

keybase -v

3- In case the the software version is vulnerable, we may create a malicious binary (which executes, for example, a rshell, creates a high privilege user, etc.) with the name fusermount and deploy it on a directory to be injected on the PATH.

NOTE: Development and compilation of the binary left for the tester

4- We add the directory in the first position inside the path variable and execute the Keybase software.

env PATH=<malicious_dir_path>:$PATH /usr/bin/keybase-redirector /keybase

This will execute the payload inside the malicious binary as root.

Personal Notes
In some engagements, I have seen this software installed on workstation or servers from DevOps/SecDevOps teams, where they manage access keys and credentials for critical corporate infrastructure. Because of this, a Keybase vulnerable installation should not be taken lightly.

Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 4