Insecure handling of file paths allows multiple local attacks
Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.
This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-73 | CWE-73 External Control of File Name or Path |
| CWE | CWE-379 | CWE-379 Creation of Temporary File in Directory with Insecure Permissions |
Type: CWE
Description: CWE-73 External Control of File Name or Path
Type: CWE
Description: CWE-379 Creation of Temporary File in Directory with Insecure Permissions
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 6.1 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Version: 3.1
Base score: 6.1
Base severity: MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Impacts
| CAPEC ID | Description |
|---|
| N/A | If an attacker has access to a local unprivileged user account, and the Kea API entry points are not secured, the attacker can use the API to arbitrarily modify Kea's configuration or to overwrite any file Kea has write access to. If Kea is running as root, the attacker could overwrite any local file. This can lead to local privilege escalation and/or system-wide denial of service. If control sockets are placed in an insecure location, any local user may be able to impersonate a Kea service or prevent the real Kea service from starting. |
CAPEC ID: N/A
Description: If an attacker has access to a local unprivileged user account, and the Kea API entry points are not secured, the attacker can use the API to arbitrarily modify Kea's configuration or to overwrite any file Kea has write access to. If Kea is running as root, the attacker could overwrite any local file. This can lead to local privilege escalation and/or system-wide denial of service. If control sockets are placed in an insecure location, any local user may be able to impersonate a Kea service or prevent the real Kea service from starting.