Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-x5q3-c8rm-w787
No affected components available
Authd PAM module up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
This is possible using tools such as su, sudo or ssh (and potentially others) that, so far, do not ensure that the PAM user at the end of the transaction is matching the one who initiated the transaction.
Authd 0.3.5 fixes this by not allowing changing the user unless it was never set before in the PAM stack.
su version that will include https://github.com/util-linux/util-linux/pull/3206 will not be affected
ssh version that will include https://github.com/openssh/openssh-portable/pull/521 will not be affected
sudo version that will include https://github.com/sudo-project/sudo/pull/412 will not be affected
login not affected
passwd not affected
Summary
An user can access as another user using its own credentials
Details
I feel we’ve a security issue that is due to the fact that we allow changing the user in the cases in which that’s already provided by PAM, I’ve not tested this using the entra-id broker but it’s reproducible with the example one, but unless I’m missing something it should be independent from the broker in use.
Basically, by going to the user selection page we allow to login as any user by entering the use own credentials.
See for example: https://asciinema.org/a/VIcjpDImomaGu0wxsJJxNdmlf or https://asciinema.org/a/CV3D1gaEhn2yclqSMKCnifYPo
Basically it’s possible to logging in as user1 using the credentials of user2 or user3.
The issue doesn’t affect login or passwd, but it does affect su and sshd, since in both cases they don’t check if the PAM_USER changed before the final authentication.
Now, while those tools should likely be fixed to only read the PAM_USER once pam gave them the final ok, I think authd should not allow changing the user at all when it has been provided by PAM.
</details>The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard