CVE-2018-12027

Vulnerability

An insecure permissions vulnerability exists in Phusion Passenger versions 5.3.x prior to 5.3.2 within the SpawningKit component [1][2]. When a Passenger-spawned application process reports that it listens on a certain Unix domain socket, if any of the parent directories of that socket are writable by a normal user other than the application's user, the non-application user can swap that directory with an alternative one. This results in traffic being redirected to a process controlled by the non-application user through an alternative Unix domain socket, leading to information disclosure [1].

Exploitation

The attacker must be a local user with write access to a parent directory of the Unix domain socket used by the Passenger-spawned application process [1]. The attacker does not need to be the application's user. By swapping the directory, the attacker can intercept or redirect socket-based communication intended for the legitimate application process to a socket they control [1].

Impact

Successful exploitation leads to redirection of traffic intended for the legitimate application process. This can result in information disclosure, as the attacker can intercept data sent over the Unix domain socket [1][4]. The impact is limited to local users with the required directory write permissions.

Mitigation

Users should upgrade to Phusion Passenger version 5.3.2 or later, where this vulnerability is fixed [1][2]. Gentoo users can update via the package manager with emerge --ask --oneshot --verbose ">=www-apache/passenger-5.3.2" [4]. No known workaround is available for unpatched versions [4].