T07 · Tool Hijacking and Spoofing
Warning
- Location
- benchmarks/lui_conflict_50_cases/tools/run_benchmark.py:27
- Finding
- Benchmark Runner Executes a Hard-Coded External Script## Vulnerability Details **File Location**: `benchmarks/lui_conflict_50_cases/tools/run_benchmark.py:27, 64-70` **Vulnerability Type**: Untrusted external tool execution **Risk Level**: Medium ### Vulnerable Code ```python CHECKER = Path("/Users/wangzhilelelelele/.agents/skills/scheduled-task-conflict-checker/scripts/check_scheduled_task_conflicts.py") ``` ```python completed = subprocess.run( [sys.executable, str(CHECKER), str(TEMP_INPUT), "--format", "json"], check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, ) ``` ### Technical Analysis The benchmark runner does not execute the checker included in the audited project. Instead, it launches a Python file from a fixed absolute path outside the project directory. Because the external file is not part of the audited artifact, its integrity and behavior cannot be guaranteed. Any user or process able to create or replace the file at that location can cause the benchmark runner to execute arbitrary Python code. The argument-list form of `subprocess.run` prevents shell metacharacter injection, but it does not mitigate execution of an untrusted script. This also undermines benchmark integrity: reported results may come from a stale, modified, or unrelated checker rather than the bundled implementation. ### Attack Path 1. An attacker obtains write access to the hard-coded `.agents/skills` location, or prepares that location before the benchmark is run. 2. The attacker creates or replaces `check_scheduled_task_conflicts.py` with malicious Python code. 3. A user follows the documented validation procedure and runs `run_benchmark.py`. 4. The runner invokes the external file through the current Python interpreter. 5. The malicious code executes with the operating-system privileges and environment of the benchmark user. ### Impact Assessment Successful exploitation permits arbitrary code execution with the benchmark runner's user privileges. Depending on those privileges ...[truncated 417 chars]
- Remediation
- ## Remediation Suggestions Resolve the checker from the project directory rather than an external user-specific location. For example: ```python PROJECT_ROOT = ROOT.parents[1] CHECKER = PROJECT_ROOT / "scripts" / "check_scheduled_task_conflicts.py" ``` Before execution: 1. Resolve both paths using `Path.resolve()`. 2. Verify that the checker is a regular file. 3. Verify that the resolved checker remains beneath the expected project root. 4. Fail closed if validation fails. 5. Optionally verify a trusted file hash in release or CI environments. 6. Remove the user-specific absolute path from the repository. 7. Regenerate benchmark results using the bundled checker. A hardened check could use: ```python project_root = PROJECT_ROOT.resolve() checker = CHECKER.resolve(strict=True) if not checker.is_file() or not checker.is_relative_to(project_root): raise RuntimeError("Checker must be a regular file inside the project") ```