# Canonical Snapcraft vulnerable to remote code execution under certain conditions

Snapcraft generated wrapper scripts with empty LD_LIBRARY_PATH entries, so running any snap app in an attacker-controlled directory loaded a malicious libc.so.6 and achieved code execution.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by (vendor credit): itszn
- Found by: itszn
- Disclosed: 2021-07-23
- CVE: CVE-2020-27348
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1073202
- Library page: https://bugbountylibrary.com/r/h1%3A1073202
- Tags: area:os domain:desktop domain:oss impact:privesc impact:rce kind:bounty platform:hackerone sev:medium tech:linux technique:source-review vuln:misconfiguration vuln:rce vuln:sandbox-escape

**Target:** Snapcraft-generated snap wrapper scripts (LD_LIBRARY_PATH)
**Root cause:** Snapcraft's bash wrapper generator emitted empty variables into LD_LIBRARY_PATH; empty path entries are interpreted by the dynamic linker as the current working directory, so libraries like libc.so.6 in CWD (or tls/ subdir) get loaded.
**Steps:**
1. Create a directory containing a malicious `libc.so.6` (or place it under `tls/`) alongside a benign file such as `amazing-movie.mp4`.
2. Run any snap-installed app from that directory, e.g. `chromium ./some_page.html` or `vlc ./amazing-movie.mp4`.
3. The wrapper's empty LD_LIBRARY_PATH entry causes the loader to pick up `./libc.so.6`, executing attacker code inside the snap container.
4. Use the app's X11 plug to escape the container and gain full user privileges (read `/etc/issue`, write `~/.bashrc`).
**How found:** Researcher inspected Snapcraft-generated wrapper scripts and noticed empty LD_LIBRARY_PATH variables; recognized the dynamic linker quirk treating empty entries as CWD, then crafted a malicious libc.so.6 to confirm.
**Exploitation:** Attacker ships a malicious libc.so.6 hidden in a `tls` subdirectory of a cloned repo or downloaded archive; victim runs a snap app (chromium, vlc, docker) from that directory, the loader resolves the malicious library, code runs in-container, then X11 plug abuse escapes to full user code execution.
**Escalation:** Container escape via X11 plug to obtain full user-level access; also affects dotfiles and non-home files after escape.
**Insight:** When auditing generated launcher/wrapper scripts, check for empty or unquoted LD_LIBRARY_PATH/LD_PRELOAD entries — the loader silently treats empty segments as the current directory, turning any 'run app in a folder' workflow into code execution.