[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

Tue Nov 15 19:10:20 UTC 2022

Carl Pearson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=63728144489de2f7f46161a6 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiYWI5YjJkYjNiMDVhNDJhMmI3Njk3NjIwYjU4ZTIzMmUiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiYWI5YjJkYjNiMDVhNDJhMmI3Njk3NjIwYjU4ZTIzMmUiLCJwIjoiaiJ9 )

Hello Shibboleth Team,

Thank you for working on this. I'm not sure I have access to post case comments in the Jira web portal so I'm trying email reply.

I did some further testing based on your feedback. I can confirm the reproduction steps described in the report do not work on Windows Server 2022 and Server 2019; I receive the same error when trying to rename the folder. The folders and files created by Shibboleth appear un-editable by an unprivileged user on Windows Server OS. I suspect Windows has increased security on Server OS but I haven't found anything specific.

While an unprivileged user can't change existing files, it appears they can create new files in the C:\opt\shibboleth-sp\sbin64\ folder. I ran "echo test > text.txt" as an unprivileged user from the sbin64/ folder on 2 different Server 2019 installs and it worked.

The ability to create files in sbin64/ as an unprivileged user would mean the vulnerability is still exploitable on Windows Server, just using a different attack vector.

When shibd.exe starts, it attempts to load several DLL libraries. The program searches several folders for the DLL files, starting with the current folder where shibd.exe starts from (C:\opt\shibboleth-sp\sbin64). I don't know if shibd.exe is doing the actual searching or if it asks Windows to load a DLL and Windows searches the current folder. If no DLL is found (and it shouldn't since no DLL file exist by default in sbin64/), Windows then searches other locations including C:\Program Files\Shibboleth\SP\lib where most Shibboleth DLL libraries appear to exist.

An unprivileged user can write a malicious DLL file into C:\opt\shibboleth-sp\sbin64\ with the same name as a legitimate DLL file shibd.exe is trying to load. When shibd.exe searches for that DLL at startup, it will load the unprivileged attacker's DLL and execute any code inside.

The technique described is DLL hijacking. I tested on Server 2019 x64, planting a malicious dll named "log4shib2_0.dll" in C:\opt\shibboleth-sp\sbin64\ as an unprivileged user. When shibd.exe next restarted, it loaded "log4shib2_0.dll" from C:\opt\shibboleth-sp\sbin64\ and executed my code.

The root cause is still permissions on the C:\opt\shibboleth-sp\sbin64\ folder. The DLL hijack is not a different vulnerability, just a different way to exploit the file permissions on Server OS.

If you would like to reproduce the DLL hijacking issue feel free to let me know and I can supply the files I used. If you are unable to create new files in C:\opt\shibboleth-sp\sbin64\ feel free to let me know and I can help investigate if needed.

The case updates sound like a fix is in progress which would prevent the DLL hijacking vector as well.

Thanks,
Carl

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiYWI5YjJkYjNiMDVhNDJhMmI3Njk3NjIwYjU4ZTIzMmUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiYWI5YjJkYjNiMDVhNDJhMmI3Njk3NjIwYjU4ZTIzMmUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:28a3636 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/b9ebcaf5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-8db37619-db6f-4e2c-aaa1-8271aeebeac8
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/b9ebcaf5/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-b5a048ec-e856-4cce-8364-59d27a871c39
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/b9ebcaf5/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-ec475c2d-7508-4b18-9dc8-01c1ff0b93cb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/b9ebcaf5/attachment-0005.png>