CVE-2019-15119

A local privilege escalation vulnerability exists in the cnlh/nps intranet penetration proxy server, affecting versions up to 0.23.2. The root cause is in the lib/install/install.go file, where after copying the binary to /usr/local/bin/nps or /usr/bin/nps, the permissions are explicitly set to 0777 via os.Chmod [1][3]. This makes the binary world-writable, violating the principle of least privilege.

The attack vector is strictly local. An unprivileged user on the system can simply overwrite the nps binary file with a malicious executable because the file permissions allow write access for everyone. No authentication or special privileges are required beyond having a local user account on the machine where nps is installed [3].

An attacker who replaces the nps binary can then wait for any privileged user (such as root or a user with sudo rights) to execute the modified binary. Upon execution, the attacker's payload runs with the privileges of the invoking user, thus achieving privilege escalation and potentially full system compromise [3].

The issue has been fixed in commit 7178b3380720e910d283036a8d39879a94105515, which changes the permissions from 0777 to 0755 [4]. Users should update to a version containing this fix or apply the patch manually. No workaround is documented other than ensuring the binary's permissions are manually corrected after installation.