PT-2020-16102 · Teamwork · Teamwork Cloud
Sickcodes
·
Published
2020-12-28
·
Updated
2021-01-04
·
CVE-2020-25507
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TeamworkCloud versions 18.0 through 19.0
Description
The issue arises from an incorrect permission assignment during the installation script, allowing a local unprivileged attacker to execute arbitrary code as root. This occurs because the installation instructs setting the system environment file
/etc/environment with world writable permissions (0777), enabling any local unprivileged user to write to /etc/environment and force all users, including root, to execute arbitrary code during the next login or reboot. Additionally, the entire home directory of the twcloud user at /home/twcloud is given world writable permissions, allowing any local unprivileged attacker to execute arbitrary code as twcloud.Recommendations
For TeamworkCloud versions 18.0 through 19.0, consider removing world writable permissions from
/etc/environment and the /home/twcloud directory to prevent arbitrary code execution. As a temporary workaround, restrict access to the /etc/environment file and the twcloud user's home directory to minimize the risk of exploitation.Exploit
Fix
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Teamwork Cloud