Insecure File Handling in nnn Local Privilege Escalation

Executive Summary

This vulnerability affects nnn versions up to 5.3 due to improper handling of the NNN_FIFO path in the main() function. The application accepts an existing NNN_FIFO path without verifying it is a valid FIFO (named pipe). Attackers can exploit this by pre-creating the predictable /tmp/nnn.fifo path as a symlink or readable regular file, leading to overwriting victim-writable files or leaking the victim's browsed paths.

Useful 0 Not Useful 0

Detection Guidance

Check for the existence of /tmp/nnn.fifo on your system. If it exists and is not a valid FIFO, it may indicate an attempt to exploit this vulnerability. Use the command: ls -l /tmp/nnn.fifo to inspect the file type.

Useful 0 Not Useful 0

Impact Analysis

An attacker could overwrite files you can write to or leak your browsed paths. This could lead to data loss, unauthorized access to sensitive information, or further exploitation depending on the overwritten files.

Useful 0 Not Useful 0

Mitigation Strategies

Remove any existing /tmp/nnn.fifo file if it is not a valid FIFO. Update nnn to a version that includes the fix for this issue. Monitor /tmp for suspicious file creations or modifications.

Useful 0 Not Useful 0