T07 · Tool Hijacking and Spoofing
Error
- Location
- scripts/deploy_hummingbot_api.sh:152
- Finding
- Global replacement of the sudo command with an unauthenticated wrapper<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy_hummingbot_api.sh:152-156` **Vulnerability Type**: Tool hijacking and command spoofing **Risk Level**: Critical ### Vulnerable Code ```bash # Set USER env var and create sudo shim if needed export USER=${USER:-root} if [ "$(id -u)" = "0" ] && ! command -v sudo &>/dev/null; then echo -e '#!/bin/bash\nwhile [[ "$1" == *=* ]]; do export "$1"; shift; done\nexec "$@"' > /usr/local/bin/sudo chmod +x /usr/local/bin/sudo fi ``` ### Technical Analysis When installation runs as root in an environment without `sudo`, the script creates `/usr/local/bin/sudo`. This replacement does not implement real `sudo` authentication, authorization, environment filtering, user switching, or command-policy enforcement. It simply exports assignment-style arguments and executes the remaining command under the current process identity. Writing a spoofed executable into a globally trusted command path exceeds the privileges necessary to deploy Hummingbot. The modification is also not disclosed in the Skill documentation. ### Attack Path 1. Run `deploy_hummingbot_api.sh install` as root in a container or environment without an existing `sudo`. 2. The installer writes the wrapper to `/usr/local/bin/sudo`. 3. A later setup script, administrator, or application resolves `sudo` through `PATH`. 4. The wrapper executes the supplied command directly as root without normal `sudo` policy checks. 5. Attacker-controlled arguments passed through such a call receive root-level execution. ### Impact Assessment This can affect every process that resolves `/usr/local/bin/sudo` before the legitimate binary. It can bypass expected privilege boundaries, create incorrect security assumptions, and execute commands with root privileges. The replacement remains on the filesystem after the installer exits. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never create or replace `/usr/local/bin/sudo`. - Detect whether the process is already root and invoke the required command directly. - If upstream build logic requires a compatibility wrapper, patch that build logic rather than modifying a globally trusted command. - If a wrapper is unavoidable, store it in a private temporary directory, invoke it by its absolute path, and delete it immediately afterward. - Add an installation integrity check that fails if unexpected global binaries would be created or modified. ]]>