Qualys: Needrestart Zero-Day Vulnerability Allows Root Access with PYTHONPATH Manipulation

CVE-2024-48990

Summary

A vulnerability has been identified in Needrestart, the tool developed by Qualys, which prior to version 3.8, can be exploited by local attackers. This flaw allows attackers to execute arbitrary code with root privileges by manipulating the PYTHONPATH environment variable when Needrestart runs the Python interpreter. By taking advantage of this vulnerability, attackers can potentially execute malicious code due to insufficient validation of user-controlled environment variables.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2024-48990
Created by Rapid7

CVE-2024-48990-PoC
Created by makuga01

CVE-2024-48990_needrestart
Created by ten-ops

More PoCs...

References