PT-2018-14514 · Vyos · Vyos

Rich Mirch · Published 2018-12-17 · Updated 2023-01-20 · CVE-2018-18556

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VyOS version 1.1.8

Description A privilege escalation issue was found, allowing operator users to execute the pppd binary with elevated permissions due to the default configuration. The issue is exacerbated by improper validation of certain input parameters, which a malicious operator user can exploit to spawn a shell with root privileges.

Recommendations For VyOS version 1.1.8, consider restricting the execution of the pppd binary to prevent operator users from running it with elevated permissions as a temporary workaround. Additionally, ensure that all input parameters are properly validated to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2018-18556

Affected Products

Vyos

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/vyos_restricted_shell_privesc.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html · Exploit
• 🔥 https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users · Exploit
• 🔥 https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases · Exploit
• https://osv.dev/vulnerability/CVE-2018-18556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18556 · Security Note