Subject: bug#28618: Emacs Security Issue

From: Dor Azouri <[email-masked]>
Date: Wed, 27 Sep 2017 13:56:46 +0000

Dear Emacs developers,

I would like to report a possible abuse one can perform on Emacs's
extensibility mechanism, that may lead to privilege escalation.

In short, a malicious actor that can execute code as one of the sudoers (in
non-elevated mode), can edit the init file, and add malicious commands to
it. Then he needs to wait for that user to invoke the editor in elevated
mode - and the plugin that was written before, will be loaded with the root
permissions.

The root cause that enables this abuse is basically incomplete separation
between regular and elevated execution modes of the editor (using "sudo").
I can suggest possible solutions to this issue, e.g.: applying better
permissions to the plugins directories.

Reproduction steps:
===================
1)  Add the following ELisp line of code to the init file. It will be
loaded on startup and execute the command “touch /stub.file”, when
“~/.emacs.d/” is the working directory.
        *(let ((default-directory "~/.emacs.d/")) (shell-command "touch
/stub.file"))*
2)  Wait for the user to invoke Emacs in elevated mode. The owner of the
newly created stub file is root.

* This simple command is just for demonstration - of course much more
complicated intentions can be achieved once Emacs is invoked with sudo.

I will be happy to provide more information as needed,
Dor Azouri