[LOCAL PRIV ESC VULN] There is a local privilege escalation in this software

[logics1]

I am writing this as a heads up to the community, there seems to be a privilege escalation vulnerability in opensnitch. The original author told me to go ahead and request the CVE as they do not believe it to have enough impact to matter and they do not plan to patch it out. I hope it is not impactful as I do not wish security incidents on anyone. I am releasing it to at least notify users that it exists and could affect them. I am not waiting since I was informed a patch would not happen. I am in the process of requesting the CVE right now (Aug 19 01:03 UTC). The write up and PoC will be made public sometime today or tomorrow (Aug 19th-20th).

[logics1]

https://github.com/logics1/opensnitch-priv-esc/

[evilsocket]

@gustavo-iniguez-goya wdyt?

[logics1]

What you are quoting there is just pointing out a default setting. However, what I also point out several times, is even if you do enable authentication, it will NOT stop local privilege escalation.

[evilsocket]

As you can see from the commits history, I've not been the active maintainer of this project for a long time. Personally, whatever the software I am running, I consider an attack scenario that requires a malicious process running on my computer, hence someone already has code execution, pretty much game over since on linux especially there are plenty of ways to escalate on desktop. This is my personal take / perspective on a software that I do not use nor maintain, and as I said in the email you are free to request a CVE and @gustavo-iniguez-goya who is the actual maintainer of this project is free to decide whether or not this needs addressing. Given that he is the only one who has actual knowledge about the current implementation.

You wrote to the wrong person buddy.

[logics1]

This repo has no security policy. I got your email as the author from your website. I wrongly assumed that you would at least point me in the right direction.

[evilsocket]

This repo has no security policy.

Again, the last time I've seen this codebase was 2018:

f71d8ce

I wrongly assumed that you would at least point me in the right direction.

I just did pinging Gustavo here, I do not have his personal email so I did what I can considering how much I care about this (see my comment about the attack scenario).

[evilsocket]

Let me add:

This repo has no security policy.

No but it has a README buddy:

[logics1]

@gustavo-iniguez-goya what is the best way to contact you confidentially? I found more vulnerabilities to disclose.