# Privilege escalation in workers container 

Malicious .deb package installed via build config prepare step gave root in the LGTM workers container via setuid backdoor.

- Payout: $1,500
- Severity: high
- Program: Semmle
- Credited: testanull
- Disclosed: 2019-09-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/692603
- Library page: https://bugbountylibrary.com/r/h1%3A692603
- Tags: domain:infra impact:internal-access impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:ci-cd tech:linux vuln:privilege-escalation vuln:rce

**Target:** LGTM build worker container (prepare step package install)
**Root cause:** The prepare step allows arbitrary package installation from a user-controlled path (/opt/src/work.deb) inside the build container, and the build runs with sudo/root privileges, so a malicious package's postinst executes as root.
**Steps:**
1. Build a malicious .deb whose postinst copies a setuid-root binary: `sudo cp /opt/src/run /suidfs/passwd && sudo chown root:root ... && sudo chmod 04755 ...`
2. Compile /opt/src/run as a setreuid(0,0) wrapper that runs argv[1] as root.
3. Upload the .deb alongside source code so it lands at /opt/src/work.deb.
4. Set build config `extraction.java.prepare.packages: - /opt/src/work.deb` so apt installs it.
5. Add after_prepare step invoking `/usr/bin/setpasswd 'id'` to run commands as root.
**How found:** Noticed the prepare step permits installing arbitrary packages and that source is imported before prepare, so a package path inside the uploaded source (/opt/src/work.deb) could be installed and its postinst run with root.
**Exploitation:** Attacker controls the source archive contents and build config; the prepare step runs `apt install -y --no-recommend /opt/src/work.deb`, executing the postinst as root, which plants a setuid binary and symlink, then after_prepare invokes it to run arbitrary commands as root in the worker container.
**Escalation:** Setuid backdoor persists in the container, allowing root command execution and dumping of sensitive data on the build server.
**Insight:** When a CI/build system lets you specify package install paths in config and imports source before prepare, point the package list at a file inside your own uploaded source to get your postinst executed as root.