CVE-2024-36587

What it actually does

Insecure file permissions on the dnscrypt-proxy binary allow a local non-privileged user to replace the executable, causing it to run attacker-controlled code with root privileges on execution.

Why it matters to the business

Local attackers can gain full system control through a DNS proxy component, risking complete host compromise, data exposure, and service disruption; low urgency given stable low exploit probability and no known campaigns.

How an attack unfolds

An attacker with a local shell account locates the dnscrypt-proxy binary, overwrites it with a malicious version using the permissive permissions, then waits for or triggers a restart or invocation that executes the replacement as root.

How to fix it

Upgrade dnscrypt-proxy to a release after v2.1.5 and ensure the binary is owned by root with 755 permissions or stricter; restrict write access to the installation directory for non-root users.

How to confirm the fix worked

Verify binary ownership and permissions with ls -l, confirm the running process is not writable by non-root users, and test that low-privileged accounts cannot modify the file.

Typical attack path

1. Obtain local non-root shell access on the host
2. Identify the installed dnscrypt-proxy binary path and permissions
3. Overwrite the binary with attacker-controlled code
4. Trigger execution of the binary to obtain root privileges

How to detect it

Inspect file modification times and ownership of the dnscrypt-proxy binary in system logs or via file integrity monitoring; look for root processes spawned from unexpected binary locations or hashes.

• dnscrypt-proxy binary with non-root ownership
• unexpected write timestamps on dnscrypt-proxy executable
• root shell or process originating from dnscrypt-proxy after local user activity

What your security team should do

• Audit all hosts running dnscrypt-proxy for the vulnerable permission configuration
• Apply updates to versions beyond v2.1.5 where available
• Harden file permissions on the binary and installation directory
• Monitor for unexpected binary modifications via file integrity tools