Fleet - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/fleet/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 26 Jan 2024 12:00:00 +0000Orbit Agent Local Privilege Escalation via Tcl Command Injectionhttps://feed.craftedsignal.io/briefs/2024-01-26-orbit-lpe/Fri, 26 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-26-orbit-lpe/The Orbit agent is vulnerable to local privilege escalation due to Tcl command injection, where a crafted password containing '}' can inject arbitrary Tcl commands and allow an unprivileged local user to execute commands as root.The Orbit agent, specifically versions prior to 4.81.1 of go/github.com/fleetdm/fleet/v4, contains a local privilege escalation vulnerability related to FileVault disk encryption key rotation on macOS. The agent collects a local user's password via a GUI dialog and directly interpolates it into a Tcl/expect script executed as root. A flaw exists in how the password is handled within the Tcl script. If a password contains a '}' character, it terminates the intended literal string and allows the injection of arbitrary Tcl commands. This allows a local unprivileged user to escalate their privileges to root. This vulnerability, identified as CVE-2026-27806, poses a significant risk to organizations using affected versions of the Orbit agent as any local user can gain full control of the system.

Attack Chain

  1. User initiates FileVault disk encryption key rotation via Orbit agent.
  2. Orbit agent prompts the user for their password through a GUI dialog.
  3. User enters a password containing the '}' character, crafting a Tcl injection payload.
  4. Orbit agent constructs a Tcl/expect script, interpolating the malicious password string into the script.
  5. The agent executes the script as root using exec.Command("expect", "-c", script).
  6. The '}' character in the password terminates the literal string within the Tcl script, injecting arbitrary Tcl commands.
  7. The injected Tcl commands are executed with root privileges.
  8. The attacker gains root access and can perform any action on the system.

Impact

Successful exploitation of this vulnerability allows any unprivileged local user to gain root access on a macOS system running a vulnerable version of the Orbit agent. This could lead to complete system compromise, including data theft, modification, or destruction, and installation of malware. The vulnerability impacts all organizations using the affected Orbit agent versions, and could affect hundreds or thousands of endpoints if widely deployed.

Recommendation

  • Upgrade the Orbit agent to version 4.81.1 or later to patch CVE-2026-27806.
  • Deploy the Sigma rule "Detect Tcl Execution via Expect with Command Injection" to identify potential exploitation attempts in your environment.
  • Monitor process creation events for the execution of expect with unusual command-line arguments, indicative of Tcl injection, using the Sigma rule "Detect Expect Process with Suspicious Arguments".
  • Implement restrictions on local user access to prevent unauthorized access and potential exploitation of the vulnerability.
]]>criticaladvisoryprivilege-escalationtcl-injectionmacos