CVE-2017-15358
HIGHCharles Proxy < 4.2.1 - Local Privilege Escalation via Race Condition in Settings Binary
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-15358. PoCs published by Mark Wadham.
AI-analyzed exploit summary This exploit leverages a race condition in Charles Proxy's suid binary to replace it with a malicious payload, granting root privileges. The script compiles a C program that spawns a root shell, then uses a symlink and timing attack to exploit the vulnerability.
Description
Race condition in the Charles Proxy Settings suid binary in Charles Proxy before 4.2.1 allows local users to gain privileges via vectors involving the --self-repair option.
Exploits (1)
This exploit leverages a race condition in Charles Proxy's suid binary to replace it with a malicious payload, granting root privileges. The script compiles a C program that spawns a root shell, then uses a symlink and timing attack to exploit the vulnerability.
References (2)
Scores
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H