CVE-2021-33393: Other (NVD-CWE-Other)
value: lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.8
Published: 2021-06-09T22:15Z
Repository: https://github.com/ipfire/ipfire-2.x
Language: Other
Files changed: lfs/backup
Commit date: 2021-05-17 20:48:59 +0000
Commit message: backup: prevent /var/ipfire/backup/bin/backup.pl from being owned by nobody

This is dangerous as nobody could write arbitrary contents to this file
and execute it afterwards.

Partially fixes: #12619

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Diff: diff --git a/lfs/backup b/lfs/backup
index 791d87adb..9d3e05735 100644
--- a/lfs/backup
+++ b/lfs/backup
@@ -1,9 +1,9 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2021  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
 # the Free Software Foundation, either version 3 of the License, or           #
 # (at your option) any later version.                                         #
@@ -28,11 +28,11 @@ VER        = ipfire
 
 THISAPP    = backup-$(VER)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = backup
-PAK_VER    = 1
+PAK_VER    = 2
 
 DEPS       =
 
 ###############################################################################
 # Top-level Rules
@@ -54,13 +54,14 @@ dist:
 ###############################################################################
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	-mkdir -p /var/ipfire/backup/bin
-	install -v -m 755 $(DIR_SRC)/config/backup/backup.pl /var/ipfire/backup/bin
+	install -v -m 755 -o root $(DIR_SRC)/config/backup/backup.pl /var/ipfire/backup/bin
 	install -v -m 644 $(DIR_SRC)/config/backup/include /var/ipfire/backup/
 	install -v -m 644 $(DIR_SRC)/config/backup/exclude /var/ipfire/backup/
 	chown nobody:nobody -R /var/ipfire/backup/
+	chown root:root -R /var/ipfire/backup/bin/
 	-mkdir -p /var/ipfire/backup/addons
 	-mkdir -p /var/ipfire/backup/addons/includes
 	-mkdir -p /var/ipfire/backup/addons/backup
 	@$(POSTBUILD)

Vulnerable code: # Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
PAK_VER    = 1
	install -v -m 755 $(DIR_SRC)/config/backup/backup.pl /var/ipfire/backup/bin
Fixed code: # Copyright (C) 2007-2021  IPFire Team  <info@ipfire.org>                     #
PAK_VER    = 2
	install -v -m 755 -o root $(DIR_SRC)/config/backup/backup.pl /var/ipfire/backup/bin
	chown root:root -R /var/ipfire/backup/bin/