Cloudanix VulnDB

CVE-2017-16355

Medium · 4.7

CVSS

4.7

EPSS

0.4%

Published

Dec 14, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A local user could create a special link that tricks the system into showing the contents of any chosen file when a status command is run.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

When running as root, the application permits local users to symlink a REVISION file in the application root to an arbitrary target and retrieve its contents via the XML output of the status query command.

Why it matters to the business

Attackers with local access can read arbitrary system files, exposing credentials or configuration data that enable further compromise; the issue affects older Passenger deployments and certain downstream packages, but carries low urgency given stable low exploit probability and absence from known exploitation lists.

How an attack unfolds

An attacker with local access creates a symlink named REVISION in the application root pointing to a chosen file, then invokes the status command with XML output to obtain the target file contents; no remote or unauthenticated steps are required.

How to fix it

Upgrade Phusion Passenger to Open Source 5.1.11 or Enterprise 5.1.10; for kubernetes-csi-external-resizer (Chainguard) and (Wolfi) apply the fixed version 0; for wordpress/wordpress apply commit 56691d83d2f9196193ab64f0a473c1e38eefa316.

How to confirm the fix worked

Verify Passenger version is at or above the fixed releases, confirm that status queries no longer disclose arbitrary file contents when REVISION symlinks are present, and scan application roots for unexpected REVISION symlinks.

Typical attack path

  1. Identify application root directory writable by the attacker
  2. Create symlink named REVISION pointing to desired target file
  3. Execute status query command with XML output option
  4. Parse returned XML to extract contents of target file

How to detect it

Search process execution logs and command histories for invocations of the status command with XML output, inspect application root directories for REVISION symlinks pointing outside expected locations, and review file-access audit trails for unexpected reads triggered by the status process.

  • passenger-status --show=xml
  • REVISION ->
  • symlink REVISION

What your security team should do

  • Apply the listed fixed versions or commits immediately to all affected packages
  • Run Passenger under a non-root account where operationally feasible
  • Monitor for local symlink creation in application directories
  • Review logs for invocations of the status command with XML output

The record

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Affected packages

Ecosystem Package Introduced Fixed
RubyGems passenger 0 5.1.11
Debian:11 passenger 0 5.0.30-1.1
Debian:12 passenger 0 5.0.30-1.1
Debian:13 passenger 0 5.0.30-1.1
Debian:9 passenger 0 5.0.30-1+deb9u1
SUSE:Linux Enterprise Module for Containers 12 rubygem-passenger 0 5.0.18-12.5.1
Ubuntu:18.04:LTS passenger 0 5.0.30-1+deb9u1build0.18.04.1
Ubuntu:20.04:LTS passenger 0 5.0.30-1.1
Ubuntu:Pro:16.04:LTS passenger 0 5.0.27-2ubuntu0.1~esm1
gem passenger 5.0.10 5.1.11

Related vulnerabilities