CVE-2019-19191: 
Shibboleth Service Provider vulnerability analysis and mitigation

Shibboleth Service Provider (SP) 3.x before 3.1.0 contained a local privilege escalation vulnerability identified as CVE-2019-19191. The vulnerability was discovered in November 2019 and affected the spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation (NVD, OpenSUSE).

The vulnerability exists in the spec file's post-installation script where it attempts to fix ownership of log files using chown on files in a directory controlled by the shibd service user. Due to improper validation, this allows the service user to point symlinks to sensitive files such as /etc/shadow, resulting in ownership changes of those files. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows a local attacker with shibd service account access to escalate privileges to root by manipulating symlinks to point to sensitive system files. This could lead to complete system compromise as the attacker could gain ownership of critical files like /etc/shadow (SUSE Bugzilla).

The vulnerability is locally exploitable by users with shibd service account access. A proof of concept exists demonstrating how an attacker can create a symbolic link to /etc/shadow in a directory controlled by shibd, which then gets its ownership changed to shibd during package operations (SUSE Bugzilla).

The vulnerability was fixed in Shibboleth SP version 3.1.0. Various Linux distributions have also released security updates to address this issue, including OpenSUSE Leap 15.1 and SUSE Linux Enterprise (OpenSUSE).