CVE-2020-25507

A local unprivileged attacker can write arbitrary content to `/etc/environment` because the installation script sets its permissions to `0777` (world-writable) [ref_id=1]. On the next login or reboot, every user—including root—sources this file, causing the attacker's injected commands to execute with root privileges. Separately, the attacker can write malicious files into `/home/twcloud` (also world-writable), which will be executed in the context of the `twcloud` user. No authentication or network access is required; the attacker only needs a local shell account on the affected system.

The installation script (`install_java.sh`) included in the official Teamwork Cloud documentation [ref_id=1] runs `sudo chmod 777 /etc/environment`, making the system environment file world-writable. Additionally, the home directory `/home/twcloud` is recursively given world-writable permissions during installation. These permissions affect Teamwork Cloud versions 18.0 through 19.0 (formerly Cameo Enterprise Data Warehouse / CEDW).

The advisory does not include a published patch. To remediate the vulnerability, administrators must manually correct the permissions on `/etc/environment` (e.g., `chmod 644 /etc/environment`) and on `/home/twcloud` (e.g., `chmod 755 /home/twcloud` and ensure subdirectories have appropriate restrictive permissions). The installation script should be modified to avoid granting world-writable permissions to sensitive system files and user home directories.