Local Privilege Escalation via OS Command Injection in bastionguard-firewall

Summary

BastionGuard 2.0 and 2.0.1 contain an operating-system command injection vulnerability in the bastionguard-firewall helper. The affected helper was installed with setuid-root permissions, read firewall entries from a predictable temporary file, and passed insufficiently validated input to shell commands.

Impact

A local user with low privileges could manipulate the processed input and execute arbitrary commands with root privileges, resulting in a complete compromise of confidentiality, integrity, and availability on the affected host.

Affected versions

• BastionGuard 2.0
• BastionGuard 2.0.1

Resolution

BastionGuard 2.0.2 removes setuid-root permissions from the privileged helpers, requires explicit authorization through pkexec, securely handles temporary input, strictly validates IPv4 and IPv6 entries, and executes firewall tools through fixed executable paths and separate argument vectors without invoking a shell.

Acknowledgment

The BastionGuard Security Team thanks security researcher Saku0512 for responsibly reporting the vulnerability, providing technical analysis and a proof of concept, and cooperating throughout the remediation process.