[Security-news] Hostmaster (Aegir) - Moderately critical - Access bypass, Arbitrary code execution - SA-CONTRIB-2020-031

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2020-031

Project: Hostmaster (Aegir) [1]
Version: 7.x-3.x-dev
Date: 2020-July-29
Security risk: *Moderately critical* 14∕25
AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass, Arbitrary code execution

Description: 
Aegir [3] is a powerful hosting system that sits alongside a LAMP or LEMP
server to create, deploy and manage Drupal sites.

Given that

   * Aegir can use both Apache and Nginx Web servers,
   * Apache allows configuration-writing users to escalate their privileges to
     the superuser root, and
   * Aegir's operations are performed by the GNU/Linux user aegir,

It follows that:

   * Users with access to the aegir account can escalate their privileges to
     root.
   * Any PHP code submitted through the front-end Web UI via enabling modules
     (such as PHP [4], Views PHP [5], and Computed Field [6]) could be run as
     root though a cron [7] hook implementation [8].  (Aegir runs cron through
     the aegir user via Drush [9].)

This vulnerability is mitigated by the fact that

   * an attacker must have access to the aegir account, and
   * the Web server must be Apache.

While it was generally assumed that aegir access should only be provided to
trusted users (i.e. users who also have access to root), this wasn't
explicitly stated.  The documentation has since been updated.

Solution: 
If you're running Aegir and have granted untrusted users access to the aegir
account,

   1) revoke aegir account access for users who you would not trust with root
      access,
   2) disable any module functionality on the hosted Drupal sites that allows
      PHP code to be entered on the front-end Web UI.  Computed Field, for
      example, can still be used safely by providing code from the back-end
      only.  (See Stop allowing PHP from being entered on the Web UI [10] for 
a
      plan to enforce this.)

We do not recommend switching to an Nginx Web server instead of revoking
access.  This is because there could be as-yet-unknown privilege-escalation
exploits involving Nginx (as with any other piece of software).

/Switching to Nginx/

While not recommended, if this is something you'd like to do in addition to
making the above change, we can offer some information on how to do it.

While there may eventually be a migration path to convert existing Apache
installations to Nginx, the recommended approach is currently:

   1) Set up a new Aegir installation [11] using Nginx.
   2) Remotely import sites [12] from the original Apache server.
   3) Decommission the original Apache server.

Also see the Hostmaster (Aegir) [13] project page.

Reported By: 
   * Noam Rathaus  [14]

Fixed By: 
   * Colan Schwartz  [15]

Coordinated By: 
   * Heine [16]of the Drupal Security Team
   * Greg Knaddison [17]of the Drupal Security Team


[1] https://www.drupal.org/project/hostmaster
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.aegirproject.org/
[4] https://www.drupal.org/project/php
[5] https://www.drupal.org/project/views_php
[6] https://www.drupal.org/project/computed_field
[7]
https://www.drupal.org/docs/administering-a-drupal-site/cron-automated-tasks/cron-automated-tasks-overview
[8] https://www.drupal.org/docs/creating-custom-modules/understanding-hooks
[9] https://en.wikipedia.org/wiki/Drush
[10] https://www.drupal.org/project/computed_field/issues/3143854
[11] https://docs.aegirproject.org/install/
[12] https://docs.aegirproject.org/usage/sites/importing/#remote-import
[13] https://www.drupal.org/project/hostmaster
[14] https://www.drupal.org/user/3645736
[15] https://www.drupal.org/user/58704
[16] https://www.drupal.org/user/17943
[17] https://www.drupal.org/user/36762