In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and
    Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of
    arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file
    of choice and querying passenger-status --show=xml. (CVE-2017-16355)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5261-1 advisory.

    It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder.
    An attacker could possibly use this issue to read arbitrary files. (CVE-2017-16355)

    It was discovered that Phusion Passenger had a race condition in the nginx module that could be used to     perform a symlink attack. An attacker could possibly use this issue to escalate privileges.
    (CVE-2018-12029)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An arbitrary file read vulnerability was discovered in passenger, a web application server. A local user allowed to deploy an application to passenger, can take advantage of this flaw by creating a symlink from the REVISION file to an arbitrary file on the system and have its content displayed through passenger-status.

Phusion reports :

The cPanel Security Team discovered a vulnerability in Passenger that allows users to list the contents of arbitrary files on the system.
CVE-2017-16355 has been assigned to this issue.

ID	Name	Product	Family	Severity
414090	SCA: security update for passenger (GHSA-cv3f-px9r-54hm)	Tenable Cloud Security	SCA Checks	medium
414090	SCA: security update for passenger (GHSA-cv3f-px9r-54hm)	Tenable Self-Hosted Container Security	SCA Checks	medium
183544	Ubuntu 16.04 ESM : Phusion Passenger vulnerabilities (USN-5261-1)	Nessus	Ubuntu Local Security Checks	high
123025	Debian DSA-4415-1 : passenger - security update	Nessus	Debian Local Security Checks	medium
105362	FreeBSD : rubygem-passenger -- arbitrary file read vulnerability (8cf25a29-e063-11e7-9b2c-001e672571bc)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2017-16355

medium

Tenable Plugins

medium

medium

high

medium

medium