Exploit-DB #45782
Description: LiquidVPN 1.36 / 1.37 - Privilege Escalation
Type: local
Platform: macos
Date: 2018-11-05
Author: Bernd Leitner

Exploit:
/*
=======================================================================
Title: Multiple Privilege Escalation Vulnerabilities
Product: LiquidVPN for MacOS
Vulnerable versions: 1.37, 1.36 and earlier
CVE ID(s): CVE-2018-18856, CVE-2018-18857, CVE-2018-18858, CVE-2018-18859
Impact: Critical
Homepage: https://www.liquidvpn.com
Identified: 2018-09-29
By: Bernd Leitner (bernd.leitner [at] gmail dot com)
=======================================================================

Vendor description:
-------------------
"LiquidVPN creates a secure encrypted link between your device and the
Internet.
When you connect to the Internet from your home, mobile device, office or a
WiFi
hotspot with encryption your traffic can’t be monitored by 3rd parties like
your
ISP. Without encryption, your ISP can store information about the websites
you
use and sell that data to anyone willing to pay for it. Some ISPs even
inject
advertisements into web pages to further profit off of the Internet service
you
pay for."

Source: https://www.liquidvpn.com


Business recommendation:
------------------------
By exploiting the vulnerabilities documented in this advisory, an attacker
can fully compromise a MacOS system with an installation of the LiquidVPN
client.

Users are urged to uninstall the application until the vendor ships a new
version
of the LiquidVPN client.


Vulnerability overview/description:
-----------------------------------
LiquidVPN installs the helper tool "com.smr.liquidvpn.OVPNHelper" for
performing
privileged (root) actions. In order to allow other LiquidVPN components to
send
messages to the helper tool, it implements an XPC service. Static code
analysis
showed, that the XPC service does not filter incoming messages. This means,
regular users (local attackers) can craft arbitrary XPC messages and send
them
to the service. This leads to the following issues:


1) "anycmd" Privilege Escalation (reserved CVE-2018-18857)

After receiving a message, the service checks for the existence of the
"anycmd" parameter:

============================================================================================
...
__text:[PII_REDACTED]0012E8                 lea     rsi, aAnycmd    ; "anycmd"
__text:[PII_REDACTED]0012EF                 mov     rdi, r14        ; char *
__text:[PII_REDACTED]0012F2                 call    _strcmp
__text:[PII_REDACTED]0012F7                 test    eax, eax
__text:[PII_REDACTED]0012F9                 jnz     loc_1000016C2
__text:[PII_REDACTED]0012FF                 mov     [rbp+var_10A38], r15
__text:[PII_REDACTED]                 lea     rsi, aCommandLine ;
"command_line"
__text:[PII_REDACTED]00130D                 mov     rdi, rbx
...
__text:[PII_REDACTED]                 lea     rsi, aR         ; "r"
__text:[PII_REDACTED]00133D                 mov     rdi, r14        ; char *
__text:[PII_REDACTED]                 call    _popen
...
============================================================================================

If "anycmd" is found, the "command_line" parameter is extracted from the
message
and directly passed on to a call to popen() as an argument.


2) "openvpncmd" Privilege Escalation (reserved CVE-2018-18856)

Similar to the previous vulnerability, the service checks if the "openvpn"
parameter exists. If it does, the "openvpncmd" parameter is extracted and
passed
on to a system() call as an argument:

============================================================================================
...
__text:[PII_REDACTED]0013F1                 lea     rsi, aOpenvpncmd ;
"openvpncmd"
__text:[PII_REDACTED]0013F8                 mov     rdi, rbx
__text:[PII_REDACTED]0013FB                 call    _xpc_dictionary_get_string
...
__text:[PII_REDACTED]00166A                 mov     rdi, r15        ; char *
__text:[PII_REDACTED]00166D                 call    _system
__text:[PII_REDACTED]                 lea     rsi, aReply     ; "reply"
__text:[PII_REDACTED]                 lea     rdx, aOpenvpnCommand ;
"openvpn command executed (ver 3)"
__text:[PII_REDACTED]                 mov     rdi, r12
__text:[PII_REDACTED]                 call    _xpc_dictionary_set_string
...
============================================================================================

3) OS Command Injection (reserved CVE-2018-18858)

If the service detects the "openvpn" parameter in a message, it also checks
if
the parameters  "tun_path" or "tap_path" exist. If one of them (or both)
are found,
the values are used as source paths for a copy process using the system()
function.
However, the paths are not sanitized before being passed to system():

============================================================================================
...
__text:[PII_REDACTED]0013CD                 lea     rsi, aPathTun   ; "path_tun"
__text:[PII_REDACTED]0013D4                 mov     rdi, rbx
__text:[PII_REDACTED]0013D7                 call    _xpc_dictionary_get_string
__text:[PII_REDACTED]0013DC                 mov     r14, rax
__text:[PII_REDACTED]0013DF                 lea     rsi, aPathTap   ; "path_tap"
__text:[PII_REDACTED]0013E6                 mov     rdi, rbx
__text:[PII_REDACTED]0013E9                 call    _xpc_dictionary_get_string
...
__text:[PII_REDACTED]00143F                 call    _strcat
__text:[PII_REDACTED]                 mov     rdi, rbx        ; char *
__text:[PII_REDACTED]                 call    _strlen
...
__text:[PII_REDACTED]                 mov     rdi, rbx        ; char *
__text:[PII_REDACTED]00149A                 call    _system
..
============================================================================================

4) Loading of arbitrary Kernel Extensions (reserved CVE-2018-18859)

The previous vulnerability can also be used to directly install an arbitrary
kernel extension. When the client is installed, "tun_path" and "tap_path"
are
pointed to the application folder for installing
"/Appl