# RCA Report

## Summary
GNU InetUtils telnetd 2.7 accepts the USER environment value supplied by the telnet client’s “automatic login” feature and forwards it directly to login(1). When USER begins with “-f root”, login(1) interprets it as an option to bypass authentication, resulting in an unauthenticated root shell.

## Impact
- **Component:** GNU InetUtils telnetd (telnet server)
- **Affected versions:** 1.9.3 through 2.7 (per advisory)
- **Risk:** Critical — remote, unauthenticated root access via crafted USER environment value passed through telnet’s `-a` auto-login.

## Root Cause
telnetd uses the USER environment variable for automatic login and passes it as an argument to login(1) without validating that it represents a legitimate username. Because login(1) treats values beginning with “-” as command-line flags, a malicious value like `-f root` causes login(1) to skip authentication and log in as root. The fix should reject or escape USER values that begin with “-” before invoking login(1) (or pass it via a safe API rather than as raw argv data).

## Reproduction Steps
1. Run `repro/reproduction_steps.sh`.
2. The script builds inetutils 2.7, launches inetd + telnetd on localhost:2323, and uses an expect-based telnet client with `USER='-f root'` and `-a` automatic login.
3. Expected evidence: a root shell prompt and `uid=0(root)` output captured in logs.

## Evidence
- **Logs:**
  - `logs/expect_exploit.log` (telnet session transcript)
  - `logs/result.log` (script verdict)
  - `logs/inetd.log` (inetd debug output)
- **Key excerpt (from `logs/expect_exploit.log`):**
  - `root@runsc:~# id`
  - `uid=0(root) gid=0(root) groups=0(root)`
- **Environment:** Ubuntu 24.04.3 LTS container, inetutils 2.7 built from GNU tarball.

## Recommendations / Next Steps
- Sanitize/validate USER input before passing to login(1); reject values beginning with “-” or any value containing whitespace or option-like prefixes.
- Prefer execve with a fixed argv array where USER is passed as a data argument only after validation.
- Upgrade to a patched release once available and add regression tests for USER values like `-f root`, `--help`, and `-p` to ensure login flags cannot be injected.

## Additional Notes
- **Idempotency:** `repro/reproduction_steps.sh` was executed twice successfully without modification.
- **Limitations:** The reproduction uses inetd in debug mode on localhost:2323; production deployments using system inetd/xinetd should be tested similarly, but the vulnerability is present in telnetd’s login invocation logic itself.