Linux rhosts and hostsequiv Misconfiguration Vulnerability

漏洞信息

漏洞名称： Linux .rhosts and hosts.equiv Misconfiguration Vulnerability

漏洞类型： 配置问题

漏洞等级： 高危

漏洞描述： 该漏洞涉及Linux系统中.rhosts和/etc/hosts.equiv文件的配置问题。这些文件用于远程命令执行（如rlogin、rsh）的授权控制。如果这些文件存在或配置不当，可能导致未授权的远程命令执行。具体来说，漏洞检测包括检查这些文件的存在性、权限设置是否不当，以及是否使用了不安全的“+”符号。Linux作为一种广泛使用的操作系统，其安全性对企业和个人用户都至关重要。这种配置问题可能导致攻击者绕过正常的认证机制，执行恶意命令，从而获取系统权限或泄露敏感信息。由于这种漏洞不需要复杂的攻击手段即可利用，因此被评级为高危。攻击者可以利用此漏洞进行远程代码执行，进而控制受影响的系统，对数据安全和系统稳定性构成严重威胁。

产品名称： Linux

来源： https://github.com/projectdiscovery/nuclei-templates/blob/dfc176303ffebe3d9f231045fa3abe2cf2ca9874/misconfiguration%2Flinux%2Flinux-rhosts-hostsequiv-check.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: linux-rhosts-hostsequiv-check

info:
  name: Detect presence or misconfiguration of .rhosts and hosts.equiv
  author: songyaeji
  severity: high
  description: >
    Presence or misconfiguration of .rhosts or /etc/hosts.equiv files can allow unauthorized remote command execution (rlogin, rsh).
    This template detects existence and improper permissions or unsafe "+" usage in these files.
  reference:
    - https://isms.kisa.or.kr
    - Cloud Vulnerability Assessment Guide(2024) by KISA
    - https://linux.die.net/man/5/hosts.equiv
  tags: linux,local,misconfig,rhosts,compliance
  metadata:
    verified: true
    os: linux
    max-request: 1
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cwe-id: CWE-732

self-contained: true

code:
  - engine:
      - bash
    source: |
      # Check if /etc/hosts.equiv exists
      if [ -f /etc/hosts.equiv ]; then
        echo "[FOUND] /etc/hosts.equiv exists"
        ls -l /etc/hosts.equiv
        echo "[CONTENT]"
        cat /etc/hosts.equiv
      fi

      # Check if any .rhosts files exist under home directories
      find /home -maxdepth 2 -name ".rhosts" 2>/dev/null | while read rhost; do
        echo "[FOUND] $rhost"
        ls -l "$rhost"
        echo "[CONTENT]"
        cat "$rhost"
      done
    matchers:
      - type: word
        part: code_1_response
        words:
          - "/etc/hosts.equiv"
          - ".rhosts"