Potential Security Flaw in IPFire 2.25-core155 Due to Improper File Ownership

CVE-2021-33393

What is CVE-2021-33393?

The backup routine in IPFire 2.25-core155 is vulnerable due to improper file ownership of the backup script located at /var/ipfire/backup/bin/backup.pl. This script could potentially be owned by an unprivileged user, allowing a malicious actor to inject a Trojan horse script. If executed, this could lead to unauthorized access and execution of arbitrary code by a privileged user, posing a significant risk to system integrity and security. Other files within the system may also suffer from similar ownership and permission issues, further compounding the potential vulnerabilities.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2021-33393
Created by Rapid7

IPFire_2.25_RCE_Authenticated
Created by joaoaugustom

References