[GH-ISSUE #279] [Bug] Privilege Escalation in the XFCE container #85

New issue

Open

opened 2026-10-15 12:48:50 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:48:50 +00:00

Owner

Originally created by @lifeofal3af on GitHub (Dec 25, 2025).
Original GitHub issue: https://github.com/games-on-whales/gow/issues/279

Due to these lines in the XFCE Container's dockerfile:

COPY --chmod=777 scripts/launch-comp.sh scripts/startup.sh /opt/gow/
COPY --chmod=777 scripts/startdbus.sh /opt/gow/startdbus

any unprivileged user can escalate to root by simply writing to the startdbus script which is passwordless when using sudo as we can see in :

# Allow anyone to start dbus without password 
RUN echo "\nALL ALL=NOPASSWD: /opt/gow/startdbus" >> /etc/sudoers

This can be problematic if any unauthorized user got access and potentially compromise the system.

POC (simplest POC i've ever written tbh 😭 )

echo "bash" > /opt/gow/startdbus
sudo /opt/gow/startdbus

Originally created by @lifeofal3af on GitHub (Dec 25, 2025). Original GitHub issue: https://github.com/games-on-whales/gow/issues/279 Due to these lines in the XFCE Container's dockerfile: ``` COPY --chmod=777 scripts/launch-comp.sh scripts/startup.sh /opt/gow/ COPY --chmod=777 scripts/startdbus.sh /opt/gow/startdbus ``` any unprivileged user can escalate to root by simply writing to the startdbus script which is passwordless when using `sudo` as we can see in : ``` # Allow anyone to start dbus without password RUN echo "\nALL ALL=NOPASSWD: /opt/gow/startdbus" >> /etc/sudoers ``` This can be problematic if any unauthorized user got access and potentially compromise the system. POC (simplest POC i've ever written tbh 😭 ) ``` echo "bash" > /opt/gow/startdbus sudo /opt/gow/startdbus ```

bsakaguchi referenced this issue

2026-10-15 12:49:25 +00:00

[PR #85] [MERGED] remove extra space from assignment #140