Authd PAM module up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
This is possible using tools such as su, sudo or ssh (and potentially others) that, so far, do not ensure that the PAM user at the end of the transaction is matching the one who initiated the transaction.
Authd 0.3.5 fixes this by not allowing changing the user unless it was never set before in the PAM stack.
su version that will include util-linux/util-linux#3206 will not be affected
ssh version that will include openssh/openssh-portable#521 will not be affected
sudo version that will include sudo-project/sudo#412 will not be affected
login not affected
passwd not affected
Old report
Summary
An user can access as another user using its own credentials
Details
I feel we’ve a security issue that is due to the fact that we allow changing the user in the cases in which that’s already provided by PAM, I’ve not tested this using the entra-id broker but it’s reproducible with the example one, but unless I’m missing something it should be independent from the broker in use.
Basically, by going to the user selection page we allow to login as any user by entering the use own credentials.
See for example: https://asciinema.org/a/VIcjpDImomaGu0wxsJJxNdmlf or https://asciinema.org/a/CV3D1gaEhn2yclqSMKCnifYPo
Basically it’s possible to logging in as user1 using the credentials of user2 or user3.
The issue doesn’t affect login or passwd, but it does affect su and sshd, since in both cases they don’t check if the PAM_USER changed before the final authentication.
Now, while those tools should likely be fixed to only read the PAM_USER once pam gave them the final ok, I think authd should not allow changing the user at all when it has been provided by PAM.
Authd PAM module up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
This is possible using tools such as
su,sudoorssh(and potentially others) that, so far, do not ensure that the PAM user at the end of the transaction is matching the one who initiated the transaction.Authd 0.3.5 fixes this by not allowing changing the user unless it was never set before in the PAM stack.
suversion that will include util-linux/util-linux#3206 will not be affectedsshversion that will include openssh/openssh-portable#521 will not be affectedsudoversion that will include sudo-project/sudo#412 will not be affectedloginnot affectedpasswdnot affectedOld report
Summary
An user can access as another user using its own credentials
Details
I feel we’ve a security issue that is due to the fact that we allow changing the user in the cases in which that’s already provided by PAM, I’ve not tested this using the entra-id broker but it’s reproducible with the example one, but unless I’m missing something it should be independent from the broker in use.
Basically, by going to the user selection page we allow to login as any user by entering the use own credentials.
See for example: https://asciinema.org/a/VIcjpDImomaGu0wxsJJxNdmlf or https://asciinema.org/a/CV3D1gaEhn2yclqSMKCnifYPo
Basically it’s possible to logging in as
user1using the credentials ofuser2oruser3.The issue doesn’t affect login or passwd, but it does affect
suandsshd, since in both cases they don’t check if thePAM_USERchanged before the final authentication.Now, while those tools should likely be fixed to only read the PAM_USER once pam gave them the final ok, I think authd should not allow changing the user at all when it has been provided by PAM.