CVE-2026-17435

Executive Summary

CVE-2026-17435 is a local privilege escalation and arbitrary file creation vulnerability affecting the Perl module File::Rotate::Simple versions before 0.4.0. The flaw exists in the log rotation logic: when rotating a file that is a symbolic link to a non-existent target, and the touch option is enabled, the module creates the target file instead of properly handling the dangling symlink. An attacker capable of creating a symlink in a location writable by a privileged log-rotation process can exploit this to create arbitrary files with the permissions of the rotating process, potentially leading to privilege escalation or system compromise. The touch option is disabled by default, which reduces but does not eliminate the attack surface.

Technical Analysis

The vulnerability resides in the rotate method of File::Rotate::Simple (Perl module). The module's purpose is to manage log file rotation—renaming current logs to timestamped backups and creating fresh log files. The flaw is rooted in a logic error involving filesystem metadata checks versus the actual file operations performed.

Vulnerability Mechanism:

1. Existence Check: The module checks whether the file to be rotated exists using a -e or -f test against the path. In Perl, these operators dereference symbolic links—they evaluate the state of the target of the symlink, not the symlink itself.

2. Dangling Symlink Condition: If an attacker creates a symlink (e.g., log.txt → /etc/cron.d/backdoor) where the target does not exist, the -e check returns false, indicating the file is absent.

3. Touch Option: When the touch option is enabled (default: disabled), the module, believing the file is missing, attempts to create it. However, because the path is a symlink, the touch operation follows the link and creates the target file. This results in the creation of an arbitrary file at a location of the attacker's choosing.

4. Permission Context: The file is created with the effective UID/GID of the process running the log rotation. If this is a privileged service (e.g., syslog, root-owned cron job, or a service daemon), the attacker gains the ability to create files as that user. Combined with predictable locations (e.g., /etc/cron.d/, /etc/ld.so.preload, /root/.ssh/authorized_keys), this can lead to full system compromise.

Key Code-Level Flow (Conceptual):

sub rotate {
    my ($self, $filename) = @_;
    
    # Attacker controls $filename (e.g., via writable log directory)
    if (-e $filename) {
        # ... rename to timestamped backup
    } else {
        if ($self->{touch}) {
            # BUG: touch follows symlink, creates target even though
            # -e returned false (because target is missing)
            open(my $fh, '>>', $filename);  # creates target
        }
    }
}

Attack Surface: Any environment where:

• File::Rotate::Simple is used with touch => 1.
• The log rotation process runs with higher privileges than the attacker.
• The attacker can write a symlink into a directory scanned by the rotation process (e.g., /var/log/ if writable by an unprivileged user, or a shared temp directory).

Exploitation Scenarios

The attack chain is entirely local but can escalate impact significantly. Here is a concrete, step-by-step exploitation scenario:

Scenario: Cron-based log rotation running as root

Step 1 — Reconnaissance:

• The attacker identifies a system running a log-rotation script that uses File::Rotate::Simple with the touch option enabled. This could be discovered via:
  • Reading /etc/cron* entries for custom rotation jobs.
  • Inspecting running Perl processes with ps aux | grep -i rotate.
  • Checking /usr/local/lib/perl5 or CPAN for the module version (if < 0.4.0, vulnerable).

Step 2 — Weaponization:

• The attacker needs write access to a directory that the rotation script scans. Common candidates:
  • /var/log/ — if the attacker is a member of the adm group or has write permissions misconfigured.
  • A shared application temp directory used by a web service (attacker uploads/shapes files there).
• The attacker creates a dangling symlink targeting a sensitive location:

  ln -s /etc/cron.d/attacker-backdoor /var/log/access.log
  

  Here, /var/log/access.log does not exist or is a path the rotation script is configured to rotate.

Step 3 — Trigger:

• The attacker waits for the scheduled rotation job to run, or manually invokes the rotation script if permitted.
• The File::Rotate::Simple code checks -e /var/log/access.log, which follows the symlink to /etc/cron.d/attacker-backdoor — not found, returns false.
• Since touch is enabled, the module executes open('>>', '/var/log/access.log'), which follows the symlink and creates /etc/cron.d/attacker-backdoor with root ownership and mode 0644 (or whatever umask the root process has).

Step 4 — Payload Execution:

• The attacker writes a cron job entry into the newly created file:

  echo "* * * * * root /tmp/backdoor.sh" > /etc/cron.d/attacker-backdoor
  

  (The attacker may need to do this quickly if the rotation script later tries to write to the file, but the window is usually sufficient.)
• Within one minute, cron executes /tmp/backdoor.sh as root, which could:
  • Add a new root user: useradd -o -u 0 -g 0 attacker
  • Start a reverse shell as root.
  • Modify /etc/sudoers to grant the attacker sudo privileges.

Step 5 — Post-Exploitation:

• The attacker now has root-level persistence. They can exfiltrate data, install kernel rootkits, or pivot to other systems on the network.

Alternative Targets:

• /root/.ssh/authorized_keys — create a file containing the attacker's SSH public key, enabling direct root SSH login.
• /etc/ld.so.preload — create a preload library for persistent code execution.
• /etc/sudoers.d/attacker — grant passwordless sudo to the attacker's user.

(Note: This is a local vulnerability; no network exploitation is possible. The attacker requires initial foothold on the system and the ability to create symlinks.)

Impact Assessment

• CIA Triad Impact: High confidentiality, integrity, and availability impact. The arbitrary file creation with root privileges can lead to full system takeover, data exfiltration, and persistent backdoors.
• CVSS Context: The NVD has not assigned a CVSS score (N/A). Based on the vulnerability class (CWE-59: Improper Link Resolution Before File Access), a reasonable qualitative assessment would be Medium to High — local exploitation, but high privilege escalation potential. In absence of an official vector, defenders should treat this as CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (approximately 7.3) if the touch option is enabled and the process runs as root; lower if the process is unprivileged.
• Affected Systems: Any Perl application or cron job using File::Rotate::Simple < 0.4.0 with touch => 1. This module is commonly used in sysadmin scripts, log shippers, and custom daemons.
• Blast Radius: The attacker gains the privilege level of the rotating process. If that process runs as root (common for system log rotation), the blast radius is the entire host. Even as a non-root service user, the attacker could create files writable by that service, potentially lateral movement vectors.
• Business Impact: Service disruption (if critical system files are overwritten), compliance violations (if security logs are manipulated), and reputational damage from a root-level breach.

Detection Guidance

Detection focuses on identifying: (1) suspicious dangling symlink creation in log directories, (2) unexpected file creations in privileged paths, and (3) anomalous behavior by log-rotation processes.

Sigma Rule

title: Suspicious Symlink Creation in Log Directories
id: 6f8c9e2a-3b5d-4f7a-9c1e-2a4b6d8f0a3c
status: experimental
description: Detects creation of symlinks in writable log directories that point to sensitive system paths, a precursor to CVE-2026-17435 exploitation.
author: Threat Intel Team
date: 2026/01/15
tags:
    - attack.privilege-escalation
    - attack.t1548
    - cve.2026.17435
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith:
            - '/var/log/*'
            - '/tmp/*.log'
        Image|endswith: '/bin/ln'
        CommandLine|contains:
            - '/etc/'
            - '/root/'
            - '/usr/local/'
    condition: selection
level: high
falsepositives:
    - Legitimate system administration creating symlinks in log dirs (rare)
    - Software installers linking config files

YARA Rule

rule CVE_2026_17435_File_Rotate_Simple
{
    meta:
        author = "Threat Intel Team"
        description = "Detects Perl scripts using vulnerable File::Rotate::Simple patterns with touch option"
        date = "2026-01-15"
        reference = "CVE-2026-17435"
        severity = "high"
    strings:
        $module_use = "use File::Rotate::Simple" ascii nocase
        $touch_opt = "touch" ascii nocase
        $rotate_call = "->rotate" ascii nocase
        $symlink_pattern = "symlink" ascii nocase
        $create_open = "open(my" ascii nocase
    condition:
        $module_use and $touch_opt and $rotate_call and 1 of ($symlink_pattern, $create_open)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-17435 File::Rotate::Simple Dangling Symlink Exploit Attempt"; flow:established,to_server; content:"/etc/"; nocase; content:"cron.d"; distance:0; content:"touch"; nocase; distance:0; content:"rotate"; nocase; distance:0; classtype:attempted-admin; sid:202617435; rev:1;)

Note: This is a local file-system vulnerability; Suricata cannot directly detect the file operation. The rule above is a heuristic for remote management sessions (e.g., SSH/HTTP) where an attacker references these paths while conducting the attack.

Elastic Detection

sequence by host.name, process.entity_id with maxspan=5m
  [file where event.action == "created" and 
   file.path : ("/var/log/*", "/tmp/*.log") and
   process.name : "ln"]
  [file where event.action == "created" and 
   file.path : ("/etc/cron.d/*", "/root/.ssh/*", "/etc/sudoers.d/*", "/etc/ld.so.preload")]

This EQL query chains a symlink creation in a writable log path followed by a suspicious privileged file creation within 5 minutes.

Splunk SPL Query

index=main sourcetype=linux:audit OR sourcetype=syslog
| where like(CommandLine, "%ln -s%") AND (like(CommandLine, "%/etc/%") OR like(CommandLine, "%/root/%"))
| table _time, host, user, CommandLine, process
| join type=inner host [search index=main sourcetype=linux:audit
    | where like(path, "%/etc/cron.d/%") OR like(path, "%/root/.ssh/%") OR like(path, "%/etc/sudoers%")
    | stats earliest(_time) as file_create_time by host, path]
| where _time > file_create_time - 300 AND _time < file_create_time + 300
| stats count by host, user, CommandLine

Wazuh OSSEC Rule

<group name="cve-2026-17435,">
  <rule id="100174" level="12">
    <if_sid>550</if_sid>
    <field name="audit.data.syscall">symlink</field>
    <field name="audit.data.name">\.(log|txt)$</field>
    <field name="audit.cwd">/var/log|/tmp</field>
    <description>CVE-2026-17435: Suspicious symlink creation in log dir by $(audit.data.uid)</description>
    <group>attack.privilege_escalation,</group>
  </rule>
  <rule id="100175" level="14">
    <if_sid>550</if_sid>
    <field name="audit.data.syscall">open</field>
    <field name="audit.data.path">/etc/cron.d|/root/.ssh|/etc/sudoers</field>
    <field name="audit.data.parent">perl|logrotate</field>
    <description>CVE-2026-17435: Perl rotation process creating files in privileged location</description>
    <group>attack.privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch via NVD; not independently confirmed by vendor advisory or researcher analysis.)

Immediate Mitigations (do first):

1. Disable the touch option in any File::Rotate::Simple configuration. This eliminates the vulnerable code path entirely. If rotation is performed via Log::Log4perl or custom scripts, remove touch => 1 from the constructor arguments.
2. Audit for dangling symlinks in directories handled by rotation scripts:

   find /var/log /tmp -type l ! -exec test -e {} \; -print
   

   Remove any suspicious dangling symlinks, especially those pointing to /etc/, /root/, /usr/local/.
3. Restrict write permissions on log directories. Ensure only root or dedicated service users can create files in /var/log/ (chmod 755, owner root).

Patch/Upgrade Steps:

1. Update the module to version 0.4.0 or later. Install via CPAN:

   cpanm File::Rotate::Simple@0.4.0
   

   Or via cpan:

   cpan
   > install File::Rotate::Simple
   

2. Verify the installed version:

   perl -MFile::Rotate::Simple -e 'print $File::Rotate::Simple::VERSION'
   

   Ensure output is 0.4.0 or higher.
3. Hunt for the module across all systems and containers (many Perl-based log shippers bundle this dependency).
4. Monitor the NVD advisory for independent confirmation; if the patch is not verified, consider forking/pinning to a verified update or temporarily replacing the module with an alternative (e.g., Log::Dispatch::FileRotate).

Long-Term Hardening:

1. Principle of least privilege: Log rotation should not run as root unless absolutely necessary. Use a dedicated unprivileged user with write access only to the specific log directory.
2. Filesystem protections: Mount /var/log with nosuid,nodev,noexec where feasible. Consider chattr +i on critical system files (e.g., /etc/cron.d, /etc/sudoers.d) to prevent unauthorized creation/modification even by root processes.
3. Automated auditing: Use auditd to monitor all symlink and open syscalls to sensitive paths (/etc, /root).
4. Patch Management: Integrate CPAN module updates into a regular dependency scanning pipeline (e.g., using cpan-audit).
5. Symlink protection: Enable Linux kernel fs.protected_symlinks and fs.protected_hardlinks settings (sysctl -w fs.protected_symlinks=1) to prevent symlink following in world-writable directories.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-17435
2. CPAN Module Page: https://metacpan.org/pod/File::Rotate::Simple (check version history)
3. MITRE ATT&CK — T1222 (File and Directory Permissions Modification): https://attack.mitre.org/techniques/T1222/
4. CWE-59: Improper Link Resolution Before File Access: https://cwe.mitre.org/data/definitions/59.html
5. OWASP Symlink Attack Guidance: https://owasp.org/www-community/attacks/Symlink_Attack

Threat Actor Activity: No known in-the-wild exploitation, ransomware campaigns, or threat actor groups have been publicly associated with CVE-2026-17435 as of the report date. The vulnerability is not listed on CISA KEV (Known Exploited Vulnerabilities). Likelihood of real-world exploitation is low-to-moderate given the default-disabled touch option, but elevated in environments with custom log-rotation configurations.