z00z00z00/safenet_sac_cve-2021-42056Safenet Authentication Client Privilege Escalation - CVE-2021-42056
Based on Thales' website [1], SafeNet Authentication Client – is a middleware client that manages Thales' extensive SafeNet portfolio of certificate-based authenticators, including eTokens, SafeNet IDPrime smart cards, USB and software-based devices.
Improper permissions have been set on multiple files allowing file overwrite as root user - as well as privilege escalation (requiring multiple steps).
CWE-378: Creation of Temporary File With Insecure Permissions CWE-377: Insecure Temporary File
During installation, Safenet set chmod 777 on the following directories, and 666 on files (listing files which are still vulnerable on latest SAC version):
eToken.* are created/updated when SafeNet Authentication Client is performing different operations (eg. lock/unlock).
Two different issues:
Therefore, any local attacker can, through a symlink attack:
The same issue has been found on Windows-based system ("Everyone" set with "Full control" permissions) on these files - and didn't find any easy way to exploit with a symlink attack (blocked by default in any recent Windows systems).
drwxrwxrwx 2 root root 4.0K Jul 10 21:18 eToken.lock
-rw-rw-rw- 1 root root 0 Jul 10 21:30 'AKS ifdh [eToken 5110 SC] 00 00.lock'
It's the same for eToken.hid
drwxrwxrwx 2 root root 4.0K Jul 10 21:30 eToken.hid
-rw-rw-rw- 1 root root 0 Jul 10 21:30 global.lock
or
When token status changed (user is logging in; reconnecting through their VPN):
$ ls -laht /etc/passwdTEST -rw-rw-rw- 1 root root 0 Jul 10 21:20 /etc/passwdTEST
