Pardus Software Center Local Privilege Escalation via APT Option Injection (CVE-2026-14459 / CVE-2026-14460)

Metadata

Affected Target

Summary

Two local privilege-escalation flaws affect the pardus-software package that powers the Pardus Software Center’s PolicyKit-mediated install/update helpers. CVE-2026-14459 (CWE-88, argument injection) arises because the privileged Actions.py helper splits its packages argument on spaces and forwards the tokens directly to apt without validating package names or inserting a -- terminator, letting a low-privileged group member smuggle in APT options such as -o Dir::Bin::dpkg=<attacker script> that get executed as root. CVE-2026-14460 (CWE-862, missing authorization) is caused by the autoaptupdateaction PolicyKit action being declared with allow_any=yes, letting any local user invoke the root update helper without authentication, creating a local denial-of-service surface. The repository ships both a benign proof (poc.sh, which records id output and drops a setuid-root shell as evidence) and weaponized exploit-14459.sh / exploit-14460.sh scripts.

Vulnerability Details

Root Cause

Actions.py’s package-management functions (install/remove/upgrade/reinstall/downgrade) pass unsanitized, space-split tokens from a user-supplied string straight to the apt command line, allowing injection of the -o Dir::Bin::dpkg=<path> option to replace the dpkg backend with an attacker-controlled script that then runs as root via pkexec. Separately, the autoaptupdateaction PolicyKit policy authorizes allow_any=yes, removing any authentication requirement for the root-level AutoAptUpdate.py helper.

Attack Vector

1. Attacker is an unprivileged local user who is a member of the pardus-software group (required for CVE-2026-14459) and has no sudo rights.
2. Attacker writes a small script that stages a setuid-root copy of /bin/bash (or runs an arbitrary command) and invokes the Actions.py helper via pkexec with a package argument such as hello -o Dir::Bin::dpkg=/tmp/x.sh.
3. The unsanitized argument is forwarded to apt, which invokes the attacker’s script in place of dpkg, running it as root with no password prompt.
4. Attacker drops into the staged setuid-root shell to obtain full root access. (Independently, for CVE-2026-14460, any local user — no special group required — can invoke pkexec AutoAptUpdate.py directly due to allow_any=yes, running arbitrary vendor-supplied update logic as root without authentication, which can be abused as a local DoS.)

Impact

A local unprivileged user (CVE-2026-14459, group member) or any local user at all (CVE-2026-14460) can obtain root code execution or disrupt package management as root, resulting in full local privilege escalation or denial of service.

Environment / Lab Setup

Target:   Disposable Pardus 25 VM with pardus-software 1.0.4 and PolicyKit/pkexec installed
Attacker: Local shell access as a low-privileged user (in the pardus-software group for 14459); bash, dpkg-deb

Proof of Concept

PoC Script

See poc/poc.sh, exploit/exploit-14459.sh, and exploit/exploit-14460.sh in this folder.

1
2
3
4

./exploit/exploit-14459.sh
./exploit/exploit-14459.sh -c "id > /root/pwned"

./exploit/exploit-14460.sh -n 20

exploit-14459.sh stages a payload script that runs as root via the Dir::Bin::dpkg injection and either executes a supplied command or drops a setuid-root shell it then execs into. exploit-14460.sh repeatedly invokes the unauthenticated update helper via pkexec to demonstrate that no password prompt is required.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected setuid-root binaries appearing under /tmp (e.g. /tmp/rootbash, /tmp/.pdsh).
• pkexec audit entries for Actions.py/AutoAptUpdate.py triggered by users outside expected admin groups.
• APT logs reporting a mismatch such as “APT had planned for dpkg to do more than it reported back.”

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/dasokkk/CVE-2026-14459-14460-pardus-software on 2026-07-05.