CVE-2022-27818: Exposure of Resource to Wrong Sphere (CWE-668)
value: SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 9.1
Published: 2022-04-07T02:15Z
Repository: https://github.com/waycrate/swhkd
Language: Rust
Files changed: src/daemon.rs, src/server.rs
Commit date: 2022-03-25 20:47:56 +0530
Commit message: [patch] CVE-2022-27818

Diff: diff --git a/src/daemon.rs b/src/daemon.rs
index 251e757..6b1d07d 100644
--- a/src/daemon.rs
+++ b/src/daemon.rs
@@ -92,15 +92,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             fetch_xdg_config_path()
         };
 
         log::debug!("Using config file path: {:#?}", config_file_path);
 
-        if !config_file_path.exists() {
-            log::error!("{:#?} doesn't exist", config_file_path);
-            exit(1);
-        }
-
         let hotkeys = match config::load(&config_file_path) {
             Err(e) => {
                 log::error!("Config Error: {}", e);
                 exit(1);
             }
@@ -317,11 +312,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         }
     }
 }
 
 fn sock_send(command: &str) -> std::io::Result<()> {
-    let mut stream = UnixStream::connect("/tmp/swhkd.sock")?;
+    let sock_file_path =
+        String::from(format!("/run/user/{}/swhkd.sock", env::var("PKEXEC_UID").unwrap()));
+    let mut stream = UnixStream::connect(sock_file_path)?;
     stream.write_all(command.as_bytes())?;
     Ok(())
 }
 
 fn send_command(hotkey: config::Hotkey) {
@@ -400,14 +397,14 @@ pub fn fetch_xdg_config_path() -> std::path::PathBuf {
     };
     config_file_path
 }
 
 pub fn seteuid(uid: u32) {
-    let uid = nix::unistd::Uid::from_raw(uid);
+    let uid = Uid::from_raw(uid);
     match nix::unistd::seteuid(uid) {
         Ok(_) => log::debug!("Dropping privileges..."),
         Err(e) => {
-            log::error!("Failed to set UID: {:#?}", e);
+            log::error!("Failed to set EUID: {:#?}", e);
             exit(1);
         }
     }
 }
diff --git a/src/server.rs b/src/server.rs
index 0733e20..22fd30f 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -1,5 +1,6 @@
+use nix::unistd;
 use std::io::prelude::*;
 use std::os::unix::net::UnixListener;
 use std::{
     env, fs,
     path::Path,
@@ -10,11 +11,11 @@ use sysinfo::{ProcessExt, System, SystemExt};
 fn main() -> std::io::Result<()> {
     env::set_var("RUST_LOG", "swhks=trace");
     env_logger::init();
 
     let pid_file_path = String::from("/tmp/swhks.pid");
-    let sock_file_path = String::from("/tmp/swhkd.sock");
+    let sock_file_path = String::from(format!("/run/user/{}/swhkd.sock", unistd::Uid::current()));
 
     if Path::new(&pid_file_path).exists() {
         log::trace!("Reading {} file and checking for running instances.", pid_file_path);
         let swhkd_pid = match fs::read_to_string(&pid_file_path) {
             Ok(swhkd_pid) => swhkd_pid,

Vulnerable code:         if !config_file_path.exists() {
            log::error!("{:#?} doesn't exist", config_file_path);
            exit(1);
        }

    let mut stream = UnixStream::connect("/tmp/swhkd.sock")?;
    let uid = nix::unistd::Uid::from_raw(uid);
            log::error!("Failed to set UID: {:#?}", e);
    let sock_file_path = String::from("/tmp/swhkd.sock");
Fixed code:     let sock_file_path =
        String::from(format!("/run/user/{}/swhkd.sock", env::var("PKEXEC_UID").unwrap()));
    let mut stream = UnixStream::connect(sock_file_path)?;
    let uid = Uid::from_raw(uid);
            log::error!("Failed to set EUID: {:#?}", e);
use nix::unistd;
    let sock_file_path = String::from(format!("/run/user/{}/swhkd.sock", unistd::Uid::current()));