From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Lars Ingebrigtsen Newsgroups: gmane.emacs.bugs Subject: bug#30912: emacs as a route to privilege escalation Date: Fri, 23 Mar 2018 00:57:49 +0100 Message-ID: References: NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Trace: blaine.gmane.org 1521762974 23753 195.159.176.226 (22 Mar 2018 23:56:14 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Thu, 22 Mar 2018 23:56:14 +0000 (UTC) User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) Cc: 30912@debbugs.gnu.org To: "Nelson H. F. Beebe" Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Fri Mar 23 00:56:09 2018 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ezA40-00062p-Hx for geb-bug-gnu-emacs@m.gmane.org; Fri, 23 Mar 2018 00:56:08 +0100 Original-Received: from localhost ([::1]:35374 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ezA62-0000XY-7w for geb-bug-gnu-emacs@m.gmane.org; Thu, 22 Mar 2018 19:58:14 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:46192) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ezA5v-0000VJ-Cm for bug-gnu-emacs@gnu.org; Thu, 22 Mar 2018 19:58:08 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ezA5q-0006P4-LJ for bug-gnu-emacs@gnu.org; Thu, 22 Mar 2018 19:58:07 -0400 Original-Received: from debbugs.gnu.org ([208.118.235.43]:40344) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1ezA5q-0006Ox-HN for bug-gnu-emacs@gnu.org; Thu, 22 Mar 2018 19:58:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1ezA5q-0003Oa-8l for bug-gnu-emacs@gnu.org; Thu, 22 Mar 2018 19:58:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Lars Ingebrigtsen Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Thu, 22 Mar 2018 23:58:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 30912 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: Original-Received: via spool by 30912-submit@debbugs.gnu.org id=B30912.152176307813041 (code B ref 30912); Thu, 22 Mar 2018 23:58:02 +0000 Original-Received: (at 30912) by debbugs.gnu.org; 22 Mar 2018 23:57:58 +0000 Original-Received: from localhost ([127.0.0.1]:48241 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ezA5k-0003OG-Dr for submit@debbugs.gnu.org; Thu, 22 Mar 2018 19:57:57 -0400 Original-Received: from hermes.netfonds.no ([80.91.224.195]:47328) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ezA5i-0003O7-BF for 30912@debbugs.gnu.org; Thu, 22 Mar 2018 19:57:54 -0400 Original-Received: from cm-84.209.240.67.getinternet.no ([84.209.240.67] helo=stories) by hermes.netfonds.no with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1ezA5d-0000nK-Da; Fri, 23 Mar 2018 00:57:51 +0100 Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAG1BMVEUVAw7NDT6TCy/APkcI AQhHCBwKAgoGAAYlBhSDn0vPAAACLUlEQVQ4jXWTTY/aMBCGDVuyHJlIII4ECuqxqvuxx13ktXsE 0tAevdSMOPYQbXqEtKz42Z2xE8IidaIM1jx+Z+whIzDYnl7tNNYmBHvlNvKbMkWRK61q4pRTRu3k X1WwEUJdAaUKY04cNexoo0/liBQXljtHcdsV6hooBmgFlVMhB3vK66ridCaVe1B+94JwLMsg7C/k R4obpRsQiEm/kK/vwcD54vlj53T8UdT3wwDMb6MOQNYrtC3X2H6xwh/izeGtajGIlU5ggMuhEKRV 5WDZV1+XsARYE+hHy9g3UUP/ALd5CzqkidoAixZQS1DtGAzyBw96SG4JrFCPMEwgNg+QcJnIew/m 0KPlaE616XdYAbroBvociiHmXMFY4Z7COob1JqxWAWDrGixCceQLTLnmjJJmRyonMgZbgBargRUz Kw4EyHCXMPC5oq2PjRcMOD5sB/BuG5d7URnV6wuAaXY6LeirKxcNiKP7LKOYw3KGN9Ma2H6knf+j bfe0x5+yBrRTr8beuFHbuwbweWtb2+6+AZsGzLCUTaqnBgxQHEc1UBegJ8SfM8DXYPIf0JHvz8AK 0V0lFbi5AHgcJ5ViRIpFo2hSpalM9+fjuoSbmGUriKWsM/mvXTv08yW6BD5VgBqY0xPGYisnMq2B Mc9mnt36UdqSom6JH47niCeki/YC1NP6K1srvWOAV2BvcrSllHfWvgKUSuP9h4n8fKXwo4xpmr5c g5xJhDY0T/wDVQsL8j2Mm6YAAAAASUVORK5CYII= In-Reply-To: (Nelson H. F. Beebe's message of "Thu, 22 Mar 2018 17:41:22 -0600") X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:144539 Archived-At: "Nelson H. F. Beebe" writes: > The SANS security list today carried a pointer to this Web site: > > Abusing Text Editors with Third-party Plugins > March 15, 2018 > Dor Azouri=20 > https://safebreach.com/Post/Abusing-Text-Editors-with-Third-party-Plugins > > It links to an 11-page report of the same title at > > https://go.safebreach.com/rs/535-IXZ-934/images/Abusing_Text_Editors.pdf > > Do emacs developers wish to respond to the security attacks described > there? To save people time, I've included the Emacs-relevant bits below. It seems to be pure nonsense. You can't edit root's ~/.emacs without root privilege. ---- Emacs executes its init file when it loads, and that=E2=80=99s where a user= can add key bindings, define functions, and call external commands. It contains personal EmacsLisp code that will be executed when Em= acs starts. This file is located in one of the following locations: =E2=80=A2 For GnuEmacs, it is ~/.emacs or _emacs or ~/.emacs.d/init.el. =E2=80=A2 For XEmacs, it is ~/.xemacs or ~/.xemacs/init.el. =E2=80=A2 For AquamacsEmacs, it is ~/.emacs or ~/Library/Preferences/Aquamacs Emacs/P= references.el All you have to do is add this ELisp line of code to the=20 init file . It will execute the command =E2=80=9Ctouch /stub.file=E2=80=9D, when =E2= =80=9C~/ emacs.d/=E2=80=9D is the working directory. (let (( default-directory "~/.emacs.d/")) (shell-command " touch /stub.file ")) And the privilege escalation objective is possible here as well, because su= rprisingly, this init file can be edited without root=20 permissions. --=20 (domestic pets only, the antidote for overdose, milk.) bloggy blog: http://lars.ingebrigtsen.no