Vulnerability

The following example references code in the facebook/tac_plus repository because it is available on GitHub (the Cisco dev kit and Shrubbery Networks fork are just tarballs). However, the affected code is the same in all projects.

When a packet arrives, the start_session() function will be called to determine the type of the incoming packet (authentication, authorization, or accounting). We focus on authorization packets that are handled by author() → do_author(), which then calls pre_authorization(). This function checks if the username in the TACACAS+ packet has a before authorization command configured and executes it via call_pre_process(). The following configuration file (tac_plus.conf) shows a user with a before authorization command configured:

This function takes the command configured in before authorization and substitutes variables (e.g. $user, $name, or $address) with values from the incoming TACACAS+ packet. However, this is done without any input validation or sanitization.

The resulting command string will then be passed to my_popen() which executes the command string in the following execl() call:

This allows injection of additional commands via the remote address field in TACACS+ packets (see rem_addr, rem_addr_len in RFC8907). The same potentially works for other input fields as well.

It should be noted that the vulnerability is triggered during the authentication process. Therefore, no password is required, only a username that exists in the configuration!

Trigger the Vulnerability

Compiling and running tac_plus with this config is described in the following sections:

• Shrubbery Network tac_plus setup
• Facebook tac_plus setup

The following command runs the tacacs_client on the target daemon with the user DEFAULT. The payload that triggers the vulnerability is in the remote address field, which is set via the --rem-addr command line argument:

Executing this will result in a reverse shell connection to 192.168.1.18:1337. The username has to be one of the users that has a before authorization or after authorization directive configured in tac_plus.cfg. The trailing command list (-c service=exec) is required to hit the required code path, but the value does not matter.

The TACACS+ packet sent by the client is shown in the following screenshot in Wireshark:

The following screenshot shows a debug session right before the injected command is executed:

Affected Linux Distributions/BSD Derivates

Various Linux distributions use one of the two affected forks in their official packages (mostly the Shrubbery Networks fork). The following tables show Linux distributions and BSD derivates that use either the Shrubbery Networks or Facebook fork at the time of this writing. The list is non-exhaustive, other distributions/derivates are most likely affected as well.

Examples of how to reproduce this issue are available in the following sections:

• Shrubbery Networks tac_plus examples
• Facebook tac_plus examples