SV.FIU.PROCESS

Exposure to privilege escalation

Some process-creation system calls provide exposure to local privilege escalation. These calls are prone to attacks that allow execution of malicious code with the privileges of the host process. The SV.FIU.PROCESS_VARIANTS checker flags the following system calls:

CreateProcess
CreateProcessAsUser
CreateProcessWithLogon
ShellExecute
ShellExecuteEx
WinExec
system
_wsystem
_*exec*
_*spawn*

Vulnerability and risk

If a process-creation system call doesn't contain the full path of the .exe executable before calling the process-creation API, it creates an opportunity for attack. A search path vulnerability can allow local users to gain privileges using a malicious .exe file.

Mitigation and prevention

To prevent exposure:

Use fork, execve, and pipes to control process execution completely.
In Win32 CreateProcess, CreateProcessAsUser, or CreateProcessWithLogonW functions, don't pass a null for the first parameter, lpApplicationName, to avoid running arbitrary command. If lpApplicationName must be null, use quotation marks around the path in the second parameter, lpCommandLine:

CreateProcess(NULL, "\"C:\Program Files\foo.exe\" -L -S", ...)

Vulnerable code example #1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
  #include <stdio.h>
  #include <sys/types.h>
  #include <sys/stat.h>
  
  int main(int argc, char *argv[]) {
    int fd;
  
    if ((fd = open(argv[1], 0)) == -1) {
      error("can't open %s", argv[1]);
     return -1;
   }
   if (argc == 2) {/* execute command */
     if (execlp ("/bin/sh/", "sh", "-c", argv[1], (char*) 0)) {
 
         /* some code */
       } else {
         error("can't execute %s", argv[1]);
       }
   }
 }

Klocwork flags the use of function execlp in line 13. This system call provides possible exposure to local privilege escalation through a malicious .exe file.

Fixed code example #1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
  #include <stdio.h>
  #include <sys/types.h>
  #include <sys/stat.h>
  
  int main(int argc, char *argv[]) {
    int fd;
  
    if ((fd = open(argv[1], 0)) == -1) {
      error("can't open %s", argv[1]);
     return -1;
   }
   if (argc == 2) {/* execute command */
     if (execve ("/bin/sh/", "sh", "-c", argv[1], (char*) 0)) { 
 
         /* some code */
       } else {
         error("can't execute %s", argv[1]);
       }
   }
 }

In the fixed code, function execlp has been replaced by execve, which controls process execution, eliminating the possibility of privilege escalation.

Vulnerable code example #2

Copy

1
2
3
4
5
6
7
8
  #include <stdlib.h>
  /* Execute a program passed as a command-line argument */
  int main(char *argv[])
  {
      system(argv[1]); /* NON-COMPLIANT */

      return 0;
  }

Fixed code example #2

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
  #include <stdio.h>
  #include <stdlib.h>
  #include <unistd.h>

  int    main(int argc, char *argv[])
  {
      char *newargv[] = { NULL, "hello", "world", NULL };
      char *newenviron[] = { NULL };
  
     if (argc != 2) {
  
           fprintf(stderr, "Usage: %s <file-to-exec>\n", argv[0]);
  
           exit(EXIT_FAILURE); 
 
     }
     
     newargv[0] = argv[1];
 
     execve(argv[1], newargv, newenviron); /* COMPLIANT */
     perror("execve");                     /* execve() only returns on error */
     exit(EXIT_FAILURE);
 }

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Improper Permissions Training Video - Test your skills with a training example