PMG: Administrator to root privilege escalation via http_proxy configuration setting

Details

Insufficient input validation for the http_proxy configuration setting allowed an attacker with Administrator role to inject arbitrary contents into the /etc/apt/apt.conf.d/76pmgproxy configuration file. In particular, an APT::Update::Pre-Invoke setting is executed as the root user during package update, allowing for arbitrary command execution as root.

The issue was addressed by restricting setting http_proxy to root@pam and by parsing the setting more strictly.

This issue was privately reported by: Vo Van Phuc - VNPT Cyber Immunity (VCI) Diem - VNPT Cyber Immunity (VCI)

Fixed in

• pmg-api >= 9.1.3