T07 · Tool Hijacking and Spoofing
Warning
- Location
- scripts/record_health_data.py:71
- Finding
- PATH-Based Hijacking of the mcporter Executable## Vulnerability Details **File Location**: `scripts/record_health_data.py`, lines 71-78 **Vulnerability Type**: Untrusted executable resolution through the inherited `PATH` **Risk Level**: Medium ### Vulnerable Code ```python cmd = [ 'mcporter', '--config', '/Users/klcintw/clawd/config/mcporter.json', 'call', 'ax3-personal.record_habit', f'habitId={habit_id}', f'numberValue={value}' ] result = subprocess.run(cmd, capture_output=True, text=True, check=True) ``` ### Technical Analysis The subprocess invocation uses the bare executable name `mcporter`. Python therefore delegates executable resolution to the operating system using the process's inherited `PATH`. Although the code safely avoids `shell=True` and constructs the arguments as a list, those protections do not prevent executable-path hijacking. If an attacker can modify `PATH`, control a directory already listed before the legitimate executable, or place a counterfeit `mcporter` binary in a writable search directory, the counterfeit program will be executed. The fixed configuration argument does not mitigate this issue because it is passed directly to whichever executable is resolved first. A counterfeit executable could also imitate valid JSON output, making the invocation appear successful. ### Attack Path 1. An attacker obtains write access to a directory that precedes the legitimate `mcporter` installation directory in the Agent process's `PATH`, or causes the Skill to run with an attacker-controlled `PATH`. 2. The attacker places an executable file named `mcporter` in that directory. 3. A user message containing a supported health measurement causes `record_to_ax3` to run. 4. `subprocess.run` resolves `mcporter` through `PATH` and starts the attacker's executable. 5. The counterfeit executable runs with the same operating-system identity and permissions as the Agent process. 6. It may access Agent-readable data, alter healt ...[truncated 671 chars]
- Remediation
- ## Remediation Suggestions - Invoke `mcporter` through an absolute path located in an administrator-controlled directory rather than relying on `PATH`. - During deployment, verify that the executable is owned by a trusted account and is not writable by unprivileged users. - If dynamic discovery is unavoidable, resolve the executable once with `shutil.which`, verify the resolved path against an explicit allowlist, and reject unexpected locations. - Supply a minimal, trusted environment to `subprocess.run`, including a restricted `PATH`. - Run the Skill under a dedicated least-privileged account with access only to the required AX3 configuration and API operation. - Where supported, verify the executable's signature or expected cryptographic digest before execution.