mirror of https://gitee.com/openkylin/genmai.git
51 lines
1.6 KiB
YAML
51 lines
1.6 KiB
YAML
FormatVer: 20230306
|
||
Id: CVE-2021-3560
|
||
Belong: system
|
||
PocHazardLevel: low
|
||
Source: https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation
|
||
SiteInfo:
|
||
Name: Polkit（PolicyKit）是类Unix系统中一个应用程序级别的工具集，通过定义和审核权限规则，实现不同优先级进程间的通讯。pkexec是Polkit开源应用框架的一部分，可以使授权非特权用户根据定义的策略以特权用户的身份执行命令。
|
||
Severity: high
|
||
Description:
|
||
发现polkit可能被欺骗，绕过D-Bus请求的凭据检查，将请求者的权限提升到root用户。
|
||
ScopeOfInfluence:
|
||
0.105 ≥ policykit ≥ 0.113
|
||
References:
|
||
- https://nvd.nist.gov/vuln/detail/CVE-2021-3560
|
||
- https://ubuntu.com/security/CVE-2021-3560
|
||
SiteClassification:
|
||
CvssMetrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
||
CvssScore: 7.8
|
||
CveId: CVE-2021-3560
|
||
CweId: CWE-754,CWE-863
|
||
CnvdId: None
|
||
KveId: None
|
||
Tags:
|
||
- cve2021
|
||
- 权限提升
|
||
SiteRequests:
|
||
Implement:
|
||
ImArray:
|
||
- Inter : python3
|
||
InterArgs :
|
||
Exec : CVE-2021-3560.py
|
||
Args :
|
||
ExpireTime: 20
|
||
|
||
# < input
|
||
# > output
|
||
# . wait
|
||
# ? condition
|
||
# : content
|
||
#
|
||
#组合起来
|
||
# >. 等待直到输出
|
||
# << 输入字符
|
||
# >?判断条件
|
||
Inter:
|
||
- ">.:bash: no job control in this shell" #ture
|
||
- "<<:whoami\n"
|
||
- ">.:\n" #等待输出'\n'
|
||
- ">?:root"
|
||
Condition: None
|