T07 · Tool Hijacking and Spoofing
Error
- Location
subskills/docx/scripts/office/soffice.py:23- Finding
Predictable LD_PRELOAD Library Enables Local Tool Hijacking
- Content
View full analysis
dict: env = os.environ.copy() env["SAL_USE_VCLPLUGIN"] = "svp" if _needs_shim(): shim = _ensure_shim() env["LD_PRELOAD"] = str(shim) return env def run_soffice(args: list[str], **kwargs) -> subprocess.CompletedProcess: env = get_soffice_env() return subprocess.run(["soffice"] + args, env=env, **kwargs) _SHIM_SO = Path(tempfile.gettempdir()) / "lo_socket_shim.so" def _needs_shim() -> bool: try: s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.close() return False except OSError: return True def _ensure_shim() -> Path: if _SHIM_SO.exists(): return _SHIM_SO src = Path(tempfile.gettempdir()) / "lo_socket_shim.c" src.write_text(_SHIM_SOURCE) subprocess.run( ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], check=True, capture_output=True, ) src.unlink() return _SHIM_SO ``` ### Technical Analysis The code uses the fixed, system-wide temporary path `/tmp/lo_socket_shim.so`. If that path already exists, `_ensure_shim()` accepts the file without checking its owner, permissions, type, integrity, or content. When Unix-domain sockets are unavailable, the path is assigned to `LD_PRELOAD` and passed to LibreOffice. `LD_PRELOAD` causes the operating-system loader to load the specified shared object before normal program libraries. A malicious shared object can execute native code through a constructor as soon as LibreOffice starts. Trusting an existing file in a shared temporary directory therefore creates a local tool-hijacking primitive. The fixed C source path also permits races and interference between concurrent processes, although the ...[truncated 1319 chars]- Remediation
View remediation