module
VyOS restricted-shell Escape and Privilege Escalation
| Disclosed |
|---|
| Nov 5, 2018 |
Disclosed
Nov 5, 2018
Description
This module exploits command injection vulnerabilities and an insecure
default sudo configuration on VyOS versions 1.0.0 arbitrary system commands as root.
VyOS features a `restricted-shell` system shell intended for use by
low privilege users with operator privileges. This module exploits
a vulnerability in the `telnet` command to break out of the restricted
shell, then uses sudo to exploit a command injection vulnerability in
`/opt/vyatta/bin/sudo-users/vyatta-show-lldp.pl` to execute commands
with root privileges.
This module has been tested successfully on VyOS 1.1.8 amd64 and
VyOS 1.0.0 i386.
default sudo configuration on VyOS versions 1.0.0 arbitrary system commands as root.
VyOS features a `restricted-shell` system shell intended for use by
low privilege users with operator privileges. This module exploits
a vulnerability in the `telnet` command to break out of the restricted
shell, then uses sudo to exploit a command injection vulnerability in
`/opt/vyatta/bin/sudo-users/vyatta-show-lldp.pl` to execute commands
with root privileges.
This module has been tested successfully on VyOS 1.1.8 amd64 and
VyOS 1.0.0 i386.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.