PT-2020-16395 · Facebook · Osquery

Martin-Langhoff · Published 2020-12-16 · Updated 2020-12-18 · CVE-2020-26273

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions osquery versions prior to 4.6.0

Description The issue allows someone with administrative access to osquery to cause reads and writes to arbitrary sqlite databases on disk by using sqlite's ATTACH verb. This can lead to the creation of arbitrary files, but they will be sqlite databases. It does not appear to allow existing non-sqlite files to be overwritten. There are several mitigating factors and possible workarounds, such as running osquery as a non-root user or using a central tool to filter for the ATTACH keyword.

Recommendations For osquery versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue. As a temporary workaround, consider running osquery as a non-root user to limit the desired access levels. Restrict access to the ATTACH keyword in configurations managed by a central tool to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-26273

GHSA-4G56-2482-X7Q8

Affected Products

Osquery

References · 8

• 🔥 https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/SQLite%20Injection.md#remote-command-execution-using-sqlite-command---load_extension · Exploit
• 🔥 https://github.com/osquery/osquery/security/advisories/GHSA-4g56-2482-x7q8 · Exploit
• https://github.com/osquery/osquery/commit/c3f9a3dae22d43ed3b4f6a403cbf89da4cba7c3c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26273 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26273 · Vendor Advisory
• https://github.com/osquery/osquery/releases/tag/4.6.0 · Note
• https://t.me/cibsecurity/20909 · Telegram Post
• https://t.me/cvenotify/7354 · Telegram Post