CVE-2024-48911
📋 TL;DR
OpenCanary versions before 0.9.4 have a privilege escalation vulnerability where an unprivileged user can modify the configuration file, which is then executed with root privileges when the daemon starts. This allows local attackers to execute arbitrary commands as root. Only systems running OpenCanary with the daemon started by root are affected.
💻 Affected Systems
- OpenCanary
📦 What is this software?
Opencanary by Thinkst
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of the system, allowing complete control, data theft, and lateral movement.
Likely Case
Local privilege escalation to root, enabling installation of backdoors, persistence mechanisms, or further attacks.
If Mitigated
No impact if proper file permissions prevent unprivileged users from modifying the config file.
🎯 Exploit Status
Exploitation requires local user access and ability to modify config file. The vulnerability is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.4
Vendor Advisory: https://github.com/thinkst/opencanary/security/advisories/GHSA-pf5v-pqfv-x8jj
Restart Required: Yes
Instructions:
1. Stop OpenCanary service. 2. Update to version 0.9.4 via pip: 'pip install --upgrade opencanary==0.9.4'. 3. Restart OpenCanary service.
🔧 Temporary Workarounds
Secure config file permissions
linuxSet strict permissions on OpenCanary config file to prevent modification by unprivileged users.
chmod 600 /path/to/opencanary.conf
chown root:root /path/to/opencanary.conf
Run OpenCanary as non-root user
linuxConfigure OpenCanary to run as a dedicated non-root user with minimal privileges.
useradd -r -s /bin/false opencanary
chown -R opencanary:opencanary /etc/opencanary/
🧯 If You Can't Patch
- Move config file to root-owned directory with strict permissions (e.g., /etc/opencanary/).
- Monitor config file for unauthorized changes using file integrity monitoring tools.
🔍 How to Verify
Check if Vulnerable:
Check OpenCanary version: 'opencanaryd --version' or 'pip show opencanary'. If version is below 0.9.4, system is vulnerable.Check Version:
opencanaryd --version || pip show opencanary | grep VersionVerify Fix Applied:
Confirm version is 0.9.4 or higher: 'opencanaryd --version' should show 0.9.4+. Verify config file permissions: 'ls -la /path/to/opencanary.conf' should show root ownership and 600 permissions.📡 Detection & Monitoring
Log Indicators:
- Unexpected changes to OpenCanary config file in system logs
- OpenCanary process spawning unexpected child processes
- Authentication logs showing privilege escalation attempts
Network Indicators:
- Unusual outbound connections from OpenCanary host
- Traffic patterns inconsistent with honeypot expected behavior
SIEM Query:
source="*opencanary*" AND (event_type="config_change" OR process_name="sudo" OR user="root")