CVE-2021-31153

Vulnerability

In pleaser (a Rust sudo-like utility) before version 0.4, a local unprivileged attacker can determine whether files or directories exist in privileged locations (e.g., /root, /etc/shadow) through the search_path function, the --check option, or the -d option [1][2][3]. This affects all versions prior to the 0.4 release.

Exploitation

An attacker needs only local access to the system. They can run pleaser with a crafted file path argument or use the --check or -d flags to test existence of arbitrary files or directories. No authentication beyond an unprivileged local account is required, and no user interaction is needed [1][3].

Impact

The attacker gains knowledge of the existence of files or directories in privileged locations, leading to information disclosure (confidentiality impact). This can be used to map out system files or detect sensitive data. Integrity and availability are not affected [1][2][3].

Mitigation

The vulnerability is fixed in pleaser version 0.4 [3]. Users should upgrade to 0.4 or later. If upgrading is not immediately possible, restrict access to the pleaser binary (e.g., remove the setuid bit) to prevent exploitation [1].