Fidelis Network and Deception: Local Privilege Escalation (CVE-2022-0486)

CVE-2022-0486 encompasses a series of improper file permission vulnerabilities in Fidelis CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception. The vulnerabilities exist because the 'fidelis' user holds sudo permissions to execute specific binaries and scripts that the user also owns. This allows a local attacker to modify the files, injecting arbitrary code or spawning shells to achieve root-level privilege escalation.

Attack Chain

1. Attacker gains local command-line interface (CLI) access as the 'fidelis' user.
2. Attacker identifies a vulnerable binary or script in the /FSS/ directory (e.g., /FSS/bin/shutdown.pl) that is owned by the 'fidelis' user.
3. Attacker modifies the file permissions (e.g., chmod 700 or u+w) to allow write access.
4. Attacker overwrites the content of the target script or binary with malicious code (e.g., executing /bin/sh).
5. Attacker executes the modified file via sudo, providing a password if required by the sudoers configuration.
6. The command executes with root privileges, granting the attacker full system control.

Impact

Successful exploitation grants a local, authenticated 'fidelis' user full root-level control over the affected Fidelis component.

Recommendation

• Update all Fidelis CommandPost, Collector, Sensor, and Sandbox instances to version 9.4.5 or later immediately.
• Disable shell/SSH access to Fidelis products after initial configuration to prevent local access vectors.
• If patching is not immediately possible, restrict ownership of vulnerable files (e.g., /FSS/bin/shutdown.pl, /FSS/setup/cert_mgmt) to root:fidelis and limit group permissions to read and execute only.