bblackham/moe-cms — pull request #3 by ronalchn (2013-11-21 01:24:01+00:00)
Title: Security Issue - metafile opens files as root user

Metafile is opened with root privileges, this can be used for privilege escalation attacks.

Being allowed to execute isolate (with setsuid flag) is equivalent to granting root access, because it allows writing to arbitrary system files. Such system files could include writing a cronjob script which grants root access.

https://github.com/ronalchn/isolate-cheater demonstrates a script which can write "adduser user sudo" to a system cronjob script.

This defeats the purpose of the setsuid flag, which is supposed to be so that the user running isolate doesn't need full root access.