Incorrect permission assignment for critical resource in td-agent-builder - CVE-2020-28169

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect permissions assignment for the bin directory in the td-agent-builder plugin for Fluentd. A local user overwrite arbitrary files in the bin directory, which are later executed with elevated privileges.

Affected software

How to mitigate CVE-2020-28169

Links to Public Exploits and PoC-codes

• Exploit #6605 - Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission (August 8, 2021)

External References

• https://github.com/kenhys/td-agent-builder/commit/eec6e2dedf12f2e0c01c2bbe7b8c15b639b3b938
• https://www.fluentd.org/
• https://td-agent-package-browser.herokuapp.com/4/windows
• https://docs.fluentd.org/installation/install-by-msi
• https://github.com/fluent/fluentd/issues/3201
• https://github.com/fluent-plugins-nursery/td-agent-builder/pull/247/commits/6f9cb6393392d62caa99907c0ebbcbab6b94a3f1
• http://packetstormsecurity.com/files/160791/Fluentd-TD-agent-4.0.1-Insecure-Folder-Permission.html

Related Security Bulletins

• Privilege escalation in Fluentd td-agent-builder plugin
• Debian update for jetty9