> That seems contrived and kind of stupid? So do most bugs and seemingly safe assumptions that lead to privilege escalation. In practice, it's unlikely an unt

> That seems contrived and kind of stupid? So do most bugs and seemingly safe assumptions that lead to privilege escalation. In practice, it's unlikely an untrusted user would have access to calling logrotate directly, but would instead call it through a chain of mechanisms that each individually seem innocuous, but become dangerous when combined together. Maybe they've got a foothold through parameter pollution allowing them to execute shell scripts as the apache user, which has sudo privileges for logrotate. Combine that with the ability to write relatively arbitrary data to logs, and you can see how things might begin to fall apart. For example, here's a HackTheBox writeup [0] that exploits a race condition in logrotate on the path to getting root. It's not the exact same scenario as in OP, but it's a similar idea. [0] https://0xdf.gitlab.io/2020/07/11/htb-book.html https://0xdf.gitlab.io/2020/07/11/htb-book.html