T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/diagnostics.sh:326- Finding
Root Execution of a User-Controlled Chromium Binary
- Content
View full analysis
/dev/null); do [ -x "$candidate" ] && CHROME_BIN="$candidate" && break done if [ -z "$CHROME_BIN" ]; then CHROME_BIN=$(find /root/.cache/ms-playwright /home/*/.cache/ms-playwright -name chrome -type f 2>/dev/null | head -1) fi echo "Chrome binary: ${CHROME_BIN:-not found}" # Step 2: If Chrome binary found, test if it launches in headless mode if [ -n "$CHROME_BIN" ]; then CHROME_TEST=$(timeout 5 "$CHROME_BIN" --headless=new --no-sandbox --disable-gpu --dump-dom about:blank 2>&1) ``` ### Technical Analysis The Skill instructs users to run the diagnostic script as root. If no system-installed Chromium binary is found, the script recursively searches `/home/*/.cache/ms-playwright` and selects the first regular file named `chrome`. Home-directory cache locations are normally writable by their corresponding unprivileged users. The script does not verify: - The owner of the discovered binary. - Whether the binary or its parent directories are writable by an unprivileged account. - Whether the canonical path belongs to an approved Playwright installation. - The binary's integrity, package origin, or expected hash. - Whether the fallback file is executable before attempting to run it. - Whether execution should occur as the owner of the cache rather than as root. The selected file is subsequently executed with the root privileges of the diagnostic script. The `--no-sandbox` argument does not protect against this issue because a malicious executable can ignore all Chromium arguments. ### Attack Path 1. An unprivileged local user creates a directory under their Playwright cache: ```bash mkdir -p ~/.cache/ms-playw ...[truncated 1431 chars]- Remediation
View remediation