A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5261-1 advisory.

    It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder.
    An attacker could possibly use this issue to read arbitrary files. (CVE-2017-16355)

    It was discovered that Phusion Passenger had a race condition in the nginx module that could be used to     perform a symlink attack. An attacker could possibly use this issue to escalate privileges.
    (CVE-2018-12029)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201807-02 (Passenger: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Passenger. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could escalate privileges, execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Two flaws were discovered in ruby-passenger for Ruby Rails and Rack support that allowed attackers to spoof HTTP headers or exploit a race condition which made privilege escalation under certain conditions possible.

CVE-2015-7519 Remote attackers could spoof headers passed to applications by using an underscore character instead of a dash character in an HTTP header as demonstrated by an X_User header.

CVE-2018-12029 A vulnerability was discovered by the Pulse Security team. It was exploitable only when running a non-standard passenger_instance_registry_dir, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor. If the symlink target was to a file which would be executed by root such as root's crontab file, then privilege escalation was possible. This is now mitigated by using fchown().

For Debian 8 'Jessie', these problems have been fixed in version 4.0.53-1+deb8u1.

We recommend that you upgrade your ruby-passenger packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183544	Ubuntu 16.04 ESM : Phusion Passenger vulnerabilities (USN-5261-1)	Nessus	Ubuntu Local Security Checks	high
111225	GLSA-201807-02 : Passenger: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
110725	Debian DLA-1399-1 : ruby-passenger security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-12029

high

Tenable Plugins

high

critical

high