CVE-2020-25989 (published 2020-11-19T21:15Z)

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pritunl/pritunl-client-electron
commit_details: repo_url: https://github.com/pritunl/pritunl-client-electron
author: Zachary Huff
author_date: 2020-08-31 05:55:29-04:00
msg: Remove file before io write file
repository: repo_url: https://github.com/pritunl/pritunl-client-electron
repo_name: pritunl/pritunl-client-electron
description: Pritunl OpenVPN client
repo_language: Go
owner: pritunl
file_changes: filename: profile.go
change_type: ModificationType.MODIFY
diff: @@ -214,6 +214,7 @@ func (p *Profile) write() (pth string, err error) {
 
 	pth = filepath.Join(rootDir, p.Id)
 
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(pth, []byte(p.Data), os.FileMode(0600))
 	if err != nil {
 		err = &WriteError{
@@ -261,6 +262,7 @@ func (p *Profile) writeUp() (pth string, err error) {
 		panic("profile: Not implemented")
 	}
 
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(pth, []byte(script), os.FileMode(0755))
 	if err != nil {
 		err = &WriteError{
@@ -308,6 +310,7 @@ func (p *Profile) writeDown() (pth string, err error) {
 		panic("profile: Not implemented")
 	}
 
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(pth, []byte(script), os.FileMode(0755))
 	if err != nil {
 		err = &WriteError{
@@ -327,6 +330,7 @@ func (p *Profile) writeBlock() (pth string, err error) {
 
 	pth = filepath.Join(rootDir, p.Id+"-block.sh")
 
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(pth, []byte(blockScript), os.FileMode(0755))
 	if err != nil {
 		err = &WriteError{
@@ -468,6 +472,7 @@ func (p *Profile) writeAuth() (pth string, err error) {
 
 	pth = filepath.Join(rootDir, p.Id+".auth")
 
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(pth, []byte(username+"\n"+password+"\n"),
 		os.FileMode(0600))
 	if err != nil {
@@ -511,6 +516,7 @@ func (p *Profile) writeConfWgLinux() (pth string, err error) {
 
 	pth = filepath.Join(rootDir, p.Id+".key")
 
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(
 		pth,
 		[]byte(p.PrivateKeyWg+"\n"),
@@ -599,7 +605,7 @@ func (p *Profile) writeConfWgQuick(data *WgConf) (pth string, err error) {
 
 	pth = filepath.Join(rootDir, p.Iface+".conf")
 
-	os.Remove(pth)
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(
 		pth,
 		[]byte(output.String()),

programming_language: Go
filename: utils.go
change_type: ModificationType.MODIFY
diff: @@ -914,6 +914,7 @@ func PidInit() (err error) {
 		}
 	}
 
+	_ = os.Remove(pth)
 	err = ioutil.WriteFile(
 		pth,
 		[]byte(strconv.Itoa(os.Getpid())),

programming_language: Go