Listen to this Post
Kahi versions up to and including v0.1.0-alpha.8 are affected by three distinct privilege and permission vulnerabilities, all addressed in v0.1.0-alpha.9. These issues were discovered during a full-codebase security review conducted on 2026-05-26.
The vulnerabilities stem from inadequate privilege management within the supervisor process. When Kahi is executed with root privileges (a common deployment scenario), the intended isolation mechanisms fail in three critical ways:
1. Per-Process Privilege Drop Not Applied (High): When a process is configured with user = "uid:gid", the credential is resolved but never actually attached to the spawned child process. Consequently, the child process inherits the supervisor’s privileges (typically root) rather than dropping to the configured lower-privileged user. The intended privilege isolation is completely ineffective, and no error is raised to alert the administrator.
2. Privilege Drop Did Not Reset Supplementary Groups (Medium): When the daemon drops privileges, it sets the primary GID and UID but never invokes setgroups(2). As a result, the launching user’s supplementary groups—such as docker, which is root-equivalent—remain active after the drop and are inherited by child processes. This creates a vector for privilege escalation through group memberships that should have been revoked.
3. FastCGI Unix Socket World-Accessible by Default (Medium): A FastCGI Unix-domain socket is only subjected to `chmod()` when `socket_mode` is explicitly configured. When `socket_mode` is left unset, the socket retains the default permissions determined by the system’s umask—commonly resulting in world-accessible permissions (e.g., 0777). This permits any local user to connect to the socket, potentially exposing sensitive FastCGI communication.
The remediation in v0.1.0-alpha.9 implements a fail-closed approach: the configured credential is applied or the process refuses to start, supplementary groups are reset via `setgroups()` before setgid()/setuid(), and FastCGI Unix sockets default to 0700.
DailyCVE Form
Platform: Kahi
Version: <= v0.1.0-alpha.8
Vulnerability: Privilege drop + group leakage + world socket
Severity: High
Date: 2026-05-26
Prediction: 2026-06-15
What Undercode Say: Analytics
The vulnerabilities stem from fundamental flaws in Unix privilege management:
– Failure to call `setgroups(2)` before setgid()/setuid() leaves supplementary groups intact.
– Missing `chmod()` on FastCGI sockets relies on unsafe `umask` defaults.
– Credential resolution without attachment breaks the intended security boundary.
Verification commands:
Check running Kahi processes and their effective UID/GID ps aux | grep kahi List supplementary groups of the Kahi process cat /proc/$(pgrep kahi)/status | grep ^Groups Check FastCGI socket permissions ls -la /path/to/fastcgi.sock
Code snippet illustrating the flaw (conceptual):
// Vulnerable privilege drop (simplified)
void drop_privileges(struct config cfg) {
struct passwd pw = getpwnam(cfg->user);
if (pw) {
// uid/gid resolved but never applied to the child
// No setgroups(), no setgid(), no setuid()
}
// Child inherits supervisor's privileges
}
How Exploit:
- Privilege Escalation via Incomplete Drop: An attacker who can execute code through a Kahi-managed process (e.g., via a web application vulnerability) inherits root privileges if the supervisor runs as root. The configured low-privilege user is never applied.
- Group Persistence Attack: If the supervisor is launched by a user in the `docker` group, child processes retain that group membership after the drop. An attacker can leverage this to interact with the Docker daemon or other resources accessible only to that group.
- FastCGI Socket Interception: A local attacker can connect to the world-accessible FastCGI socket, potentially reading sensitive data, injecting requests, or pivoting to other services.
Exploit scenario (FastCGI socket):
Connect to the world-accessible socket nc -U /var/run/php-fastcgi.sock Send crafted FastCGI request to manipulate the application
Protection:
- Upgrade: Immediately upgrade to Kahi v0.1.0-alpha.9 or later.
- Workarounds for <= v0.1.0-alpha.8:
- Do not rely on per-process
user; run the supervisor directly as the intended unprivileged user. - Set an explicit restrictive `socket_mode` on FastCGI programs (e.g.,
0700). - Avoid running the supervisor as root where possible.
- Monitoring: Audit process UID/GID and socket permissions for unexpected deviations.
- Principle of Least Privilege: Ensure the supervisor and all child processes run with the minimum necessary privileges.
Impact
- Confidentiality: World-accessible FastCGI sockets expose internal communication to any local user.
- Integrity: Child processes running with root privileges or retained supplementary groups can modify system files and resources.
- Availability: Privilege mismanagement may lead to unintended process behavior or crashes.
- CVSS Score (Estimated): 7.8 (High) – Local privilege escalation with low complexity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
