Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sudoedit can edit arbitrary files

seclists.org

Post reply on HN
Print view View original

31–40 of 61 posts

Re: Sudoedit can edit arbitrary files

#31

Post by asveikau »

syrrim wrote: post #2

Is there a patch, or more detailed explanation of what causes this?

It shells out to the EDITOR environment variable, which is controlled by the less privileged user.

In this example they inject running an editor against another file.

I'm guessing you can put arbitrary code in there or point it at a locally controlled executable too. But I'm not sure. Maybe sudoedit puts more scrutiny on that variable than most, non-security programs. At any rate many text editors have lots of modules and scripting and can presumably load and execute code as the privileged user.

The workaround is to change the sudo config file to remove the EDITOR environment variable and a few others.

Re: Sudoedit can edit arbitrary files

#33

Post by endgame »

stabbles wrote: post #5

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

Ironically, even C has the tools to avoid this. You just need to be running OpenBSD: https://man.openbsd.org/unveil.2

Re: Sudoedit can edit arbitrary files

#34

Post by endgame »

lmm wrote: post #24
stabbles wrote: post #5

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

I would say a more type-oriented mentality would make this kind of bug less likely; thinking of -- as a magic value rather than a different kind of thing from a regular argument makes it easy to forget the distinction, and a mentality where you're "sanitizing a string" is far less reliable than one where you're transforming between two distinct formats.

Good point. A "parse, don't validate" approach to handling the contents of `$EDITOR` would look like `parseEditorEnv :: String -> Maybe ProgramPath`, and that parse should fail.

Re: Sudoedit can edit arbitrary files

#35

Post by remram »

inopinatus wrote: post #32

Consider this a prompt to review your /etc/sudoers for any utility whose behaviour is modified by environment variables in the env_keep list.

I don't think that's what's happening. sudoedit does NOT run the editor as root, it copies the file to a temporary as root, runs the editor as you, and copies the temporary over the target file as root when you're done editing it (at least it's supposed to).

Re: Sudoedit can edit arbitrary files

#36

Post by dllthomas »

michalsustr wrote: post #14

Why would one prefer to add sudoedit X to sudoers rather than updating file access privileges of X directly? Just curious about arguments for this use case.

In addition to what has been said already, sometimes it's nice to have guard rails, so you're a little more sure that you're only touching that thing when you mean to.

Re: Sudoedit can edit arbitrary files

#37

Post by thayne »

arp242 wrote: post #13
stabbles wrote: post #5

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

Looking at the patch[1], probably not. There isn't really a lot of complex string handling involved; it's basically just forgetting to forbid "--". I don't really see how any language choice could help you with this. [1]: https://github.com/sudo-project/sudo/commit/0274a4f3b403162a...

It shouldn't have to forbid that. The editor and privileged files shouldn't be in the same string. It should just be appending the list of temporary files to the editor command, and running that unprivileged.

Re: Sudoedit can edit arbitrary files

#38

Post by sva_ »

throw0101c wrote: post #15

I find it handy that most distros have a CVE look-up 'service': * https://security-tracker.debian.org/tracker/CVE-2023-22809 * https://ubuntu.com/security/CVE-2023-22809 * https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-22809 Debian has links to the others.

https://security.archlinux.org/

Re: Sudoedit can edit arbitrary files

#39

Post by dllthomas »

endgame wrote: post #33
stabbles wrote: post #5

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

Ironically, even C has the tools to avoid this. You just need to be running OpenBSD: https://man.openbsd.org/unveil.2

I don't think that works here. The editor is supposed to be able to access other files.

Re: Sudoedit can edit arbitrary files

#40

Post by dllthomas »

endgame wrote: post #34
lmm wrote: post #24

Earlier quoted context omitted.

I would say a more type-oriented mentality would make this kind of bug less likely; thinking of -- as a magic value rather than a different kind of thing from a regular argument makes it easy to forget the distinction, and a mentality where you're "sanitizing a string" is far less reliable than one where you're transforming between two distinct formats.

Good point. A "parse, don't validate" approach to handling the contents of `$EDITOR` would look like `parseEditorEnv :: String -> Maybe ProgramPath`, and that parse should fail.

But that's the wrong thing. The problem is not that EDITOR must be a program, but (apparently) that they're parsing the expansion of EDITOR (along with other stuff) to figure out what file to operate on.
Post reply on HN