Privilege Escalation in Phishing Updater Authorization and Temporary File Handling

CMS fields

• Advisory: Privilege Escalation in Phishing Updater Authorization and Temporary File Handling
• Advisory ID: BGSA-2026-003 (proposed; confirm availability)
• Reporter reference: BG-02
• CVE: Not assigned
• Severity: Critical (researcher-assessed; no CVSS score assigned)
• Affected version: 2.0.3 — commit bb3a210 (reproduced by the maintainer)
• Fixed version: 2.0.4 (maintainer-confirmed corrected release)
• Status: Draft — publication pending coordinated disclosure
• Meta title: BastionGuard Phishing Updater Privilege Escalation | BGSA-2026-003
• Meta description: Advisory covering a reported privileged updater trust-boundary flaw involving sudoers rules and unsafe temporary-file handling in BastionGuard 2.0.3.
• Index: No while draft; Yes after coordinated publication
• Redirect: None
• Suggested slug: phishing-updater-privilege-escalation

Advisory body (English)

Summary

The phishing updater was reported to combine overly broad passwordless sudo permissions with predictable temporary file paths and insufficient validation of privileged DNS configuration input.

Security impact

Under vulnerable configurations, a local user could manipulate data consumed by an elevated updater and influence system configuration or privileged file operations.

Affected and fixed versions

The project maintainer reproduced the reported vulnerability in BastionGuard 2.0.3, commit bb3a210. The correction is included in BastionGuard 2.0.4, as confirmed by the maintainer and supported by the reviewed source and regression tests. Versions other than the confirmed affected revision have not been exhaustively assessed.

Remediation

• Remove broad passwordless sudo authorization for the updater.
• Use restricted, validated staging owned by a trusted account rather than trusting caller-controlled temporary paths.
• Validate configuration directives before activating DNS-related services and avoid redirects to predictable public temporary paths.

Recommended action: Upgrade to the verified official BastionGuard 2.0.4 build or a later maintained release.

Verification scope

The corrected source contains restricted updater execution and staging checks, and no active reported NOPASSWD entry. The maintainer reproduced the reported historical issue; independent privileged race-condition and dnsmasq integration testing of the corrected build was not performed in this audit environment.

Credits

Reported by Shaik Ikram. The project thanks the researcher for the responsible security report and requests that publication be coordinated with the researcher’s agreed disclosure schedule.

References

• BastionGuard source repository
• Security policy

Timeline

• Report received: October 2026
• Disclosure date: To be agreed / added before publication
• Fix release date: Confirm from the published 2.0.4 release record

Editorial verification (not part of public advisory): Maintainer confirms reproduction on bb3a210 and remediation in 2.0.4. Before publication, record the released package/tag and date, reserve the advisory ID, agree disclosure timing and credit with the researcher, and evaluate CVE eligibility through the appropriate CNA. Do not invent a CVE or CVSS score.