CVE-2018-12029
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
Una condición de carrera en el módulo nginx en Phusion Passenger, desde las versiones 3.x hasta las 5.x anteriores a la 5.3.2, permite el escalado local de privilegios cuando se configura un passenger_instance_registry_dir no estándar con permisos poco estrictos. El reemplazo de un archivo con un vínculo simbólico tras haber creado el archivo, pero antes de que se cambie el propietario, conduce a que el objetivo del enlace se cambie mediante la ruta. Apuntar a archivos sensibles como el archivo crontab del root permite el escalado de privilegios.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-06-07 CVE Reserved
- 2018-06-17 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html | Mailing List |
|
| https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://blog.phusion.nl/passenger-5-3-2 | 2019-03-08 | |
| https://security.gentoo.org/glsa/201807-02 | 2019-03-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Phusion Search vendor "Phusion" | Passenger Search vendor "Phusion" for product "Passenger" | >= 3.0.0 < 5.3.2 Search vendor "Phusion" for product "Passenger" and version " >= 3.0.0 < 5.3.2" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||