CVE-2013-7383

Vulnerability

CVE-2013-7383 is a privilege-escalation vulnerability in the X2Go Server, specifically in the x2gocleansessions script. The vulnerability affects versions before 4.0.0.8 and 4.0.1.x before 4.0.1.10 [1][2]. The issue is related to insufficient sanitization of input that can include backticks, allowing command injection. The vulnerability can be triggered by remote authenticated users [2].

Exploitation

An attacker must be a remote authenticated user of the X2Go Server. By providing crafted input containing backticks (e.g., as part of session-related data), the attacker can inject arbitrary shell commands into the x2gocleansessions script, which likely executes these commands with elevated privileges [1][2]. The exact vector is not fully detailed, but backtick injection is the suspected mechanism.

Impact

Successful exploitation allows a remote authenticated attacker to escalate privileges on the server. The attacker can execute arbitrary shell commands with the privileges of the X2Go Server process, potentially gaining full control over the affected system [3]. The specific privilege level attained is not stated, but local privilege escalation is the reported impact [3]. Confidentiality, integrity, and availability may all be compromised.

Mitigation

The vulnerability is fixed in X2Go Server versions 4.0.0.8 and 4.0.1.10 [1][2]. The Gentoo Linux security advisory (GLSA 201405-26) recommends upgrading to version 4.0.1.12 or later [3]. No workaround is known at the time of disclosure [3]. Users should update to a patched version immediately.