CVE-2018-18556

EIP tracks 1 public exploit for CVE-2018-18556. PoCs published by Rich Mirch, bcoles, including Metasploit module exploits/linux/ssh/vyos_restricted_shell_privesc.

AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in VyOS's restricted shell and sudo configuration to escalate privileges to root. It leverages the `telnet` command to break out of the restricted shell and then uses a vulnerable Perl script to execute arbitrary commands as root.

A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.