Improper Privilege Management in rConfig - CVE-2019-19585

Vulnerability details

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions.

Affected software

How to mitigate CVE-2019-19585

Links to Public Exploits and PoC-codes

• Exploit #5736 - rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution (June 17, 2021)
• Exploit #5743 - Rconfig 3.x - Chained Remote Code Execution (Metasploit) (June 17, 2021)

External References

• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_lpe.sh
• https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_lpe.sh?token=

Related Security Bulletins

• Improper Privilege Management in rConfig