CovertSwarm demonstrating a full remote ‘root’ attack chain – enabled by Log4Shell (CVE-2021-44228) + PwnKit (CVE-2021-4034)
Over the past months there were several releases of new CVE’s, two of which especially have a major impact on modern systems. Today we are showing how easy it can be to go from an unauthenticated user to system access with root privileges within minutes. This is done by exploiting log4j (CVE-2021-44228) along with Polkit’s pkexec binary (CVE-2021-4034).
Proof of Concept Exploit
The vulnerable setup can be found in this github
Description
Credit: Fastly
The log4j vulnerability is present in the X-Api-Header and will be exploited by supplying an attacker-controlled LDAP Server that will in turn redirect the victim to load a malicious Java class. When the victim parses the new component and executes the payload supplied by the attacker, this causes remote code execution in the context of the user that runs the vulnerable application.
Going further with this, on compromise of the underlying operation system, the attacker attempts to gain root privileges by exploiting the Policy Kit pkexec binary. Since the vulnerability was present on the operation system the attacker obtains root privileges within minutes of gaining the initial foothold on the operation system.
Remediation
Vendor patches have been released for both vulnerabilities and it is recommended to patch the vulnerable systems immediately. A temporary solution for the Policy Kit exploit is to change the permissions of the present pkexec binary
chmod 0755 /usr/bin/pkexec
If the binary is not present at this path you can try to locate it with the following command
find / - name *’pkexec’* 2>/dev/null
References
https://www.covertswarm.com/post/critical-0-day-security-vulnerability-log4shell-rce
https://www.covertswarm.com/post/critical-0-day-vulnerability-in-polkit-pkexec-component
Remote Work Security Gaps Still Driving UK Breaches
Despite years of adaptation, organizations are still being breached through remote access blind spots.
Part 1: CBEST Series – Beyond the Checklist
Explore how threat-led penetration testing helps financial institutions go beyond traditional checks to strengthen resilience and meet regulatory expectations like CBEST, STAR-FS and DORA.
EchoLeak: The Zero-Click Microsoft Copilot Exploit That Changed AI Security
AI tools like Microsoft 365 Copilot are changing how organizations work, but they are also introducing new security risks that are harder to detect and even…