PT-2018-2735 · Phusion+2 · Phusion Passenger+2

Denis Andzakovic · Published 2018-06-17 · Updated 2022-05-14 · CVE-2018-12029

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phusion Passenger versions 3.x through 5.x before 5.3.2

Description The issue is related to a race condition in the nginx module of Phusion Passenger, which can be exploited when a non-standard passenger instance registry dir with insufficiently strict permissions is configured. This can allow a remote attacker to access sensitive data or a local attacker to escalate privileges by replacing a file with a symlink after the file was created but before it was chowned, potentially targeting sensitive files.

Recommendations For Phusion Passenger versions 3.x through 5.x before 5.3.2, update to version 5.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the passenger instance registry dir to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2019-01638

CVE-2018-12029

DLA-1399-1

GHSA-JJCJ-FGFM-9G9R

OPENSUSE-SU-2024:11341-1

SUSE-SU-2018:2039-1

SUSE-SU-2018_2039-1

USN-5261-1

Affected Products

Phusion Passenger

Suse

Ubuntu

References · 24

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12029.yml · Exploit
• https://ubuntu.com/security/notices/USN-5261-1 · Vendor Advisory
• https://blog.phusion.nl/passenger-5-3-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12029 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:2039-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201807-02 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12029 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-12029 · Security Note
• https://osv.dev/vulnerability/DLA-1399-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16355 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12029 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12029 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01638 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12029 · Vendor Advisory