// For flags

CVE-2021-29428

Local privilege escalation through system temporary directory

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. This vulnerability impacted builds using precompiled script plugins written in Kotlin DSL and tests for Gradle plugins written using ProjectBuilder or TestKit. If you are on Windows or modern versions of macOS, you are not vulnerable. If you are on a Unix-like operating system with the "sticky" bit set on your system temporary directory, you are not vulnerable. The problem has been patched and released with Gradle 7.0. As a workaround, on Unix-like operating systems, ensure that the "sticky" bit is set. This only allows the original user (or root) to delete a file. If you are unable to change the permissions of the system temporary directory, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only. For additional details refer to the referenced GitHub Security Advisory.

En Gradle versiones anteriores a 7.0, en sistemas similares a Unix, el directorio temporal del sistema puede ser creado con permisos abiertos que permiten a varios usuarios crear y eliminar archivos dentro de él. Las compilaciones de Gradle podrían ser vulnerables a una escalada de privilegios local de un atacante que elimine y vuelva a crear rápidamente archivos en el directorio temporal del sistema. Esta vulnerabilidad afectó las compilaciones que usan plugins de script precompilados escritos en Kotlin DSL y pruebas para plugins de Gradle escritos con ProjectBuilder o TestKit. Si tiene Windows o versiones modernas de macOS, no es vulnerable. Si está en un sistema operativo similar a Unix con el bit "sticky" configurado en el directorio temporal de su sistema, no es vulnerable. El problema se ha corregido y publicado con Gradle 7.0. Como solución alternativa, en sistemas operativos similares a Unix, asegúrese de que el bit "sticky" está establecido. Esto solo permite que el usuario original (o root) elimine un archivo. Si no puede cambiar los permisos del directorio temporal del sistema, puede mover el directorio temporal de Java configurando la propiedad del sistema `java.io.tmpdir`. La nueva ruta debe limitar los permisos solo al usuario de la compilación. Para obtener detalles adicionales, consulte el Aviso de Seguridad de GitHub al que se hace referencia

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-03-30 CVE Reserved
  • 2021-04-13 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-276: Incorrect Default Permissions
  • CWE-378: Creation of Temporary File With Insecure Permissions
  • CWE-379: Creation of Temporary File in Directory with Insecure Permissions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Gradle
Search vendor "Gradle"
 Gradle
Search vendor "Gradle" for product "Gradle"
 < 7.0
Search vendor "Gradle" for product "Gradle" and version " < 7.0"
-
Affected
Quarkus
Search vendor "Quarkus"
 Quarkus
Search vendor "Quarkus" for product "Quarkus"
 <= 2.2.3
Search vendor "Quarkus" for product "Quarkus" and version " <= 2.2.3"
-
Affected