T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:303
- Finding
- Passwordless Root Access Through Broad npx Sudoers Rules## Vulnerability Details **File Location**: `SKILL.md`, lines 303-308 **Vulnerability Type**: Passwordless privilege escalation through an overly broad sudoers policy **Risk Level**: High ### Vulnerable Code ```bash ## Sudoers Setup For Playwright browser installation: # /etc/sudoers.d/playwright username ALL=(root) NOPASSWD: /usr/bin/npx playwright install-deps * username ALL=(root) NOPASSWD: /usr/bin/npx playwright install * ``` ### Technical Analysis The documented sudoers configuration grants the specified user persistent, passwordless permission to execute two `npx` command patterns as root. Both rules accept wildcard arguments, while `npx` is a package-resolution and execution utility rather than a narrowly scoped administrative binary. The effective code executed by `npx` can be affected by the installed package version, npm configuration, package-resolution context, and package lifecycle or installation behavior. Granting root access to such a general package execution mechanism violates least privilege. The authorization also remains active across sessions until the sudoers entry is removed. This issue becomes especially dangerous when combined with the unpinned dependency installation documented elsewhere in the file. A compromised Playwright release, npm configuration, package cache, or locally resolved package could cause package-controlled behavior to run with root privileges. ### Attack Path 1. An administrator installs the recommended sudoers rules for a regular user. 2. An attacker compromises that user account or gains the ability to influence its Node/npm package-resolution environment. 3. The attacker introduces or causes resolution of package-controlled content through the local project, npm configuration, cache, or a compromised dependency release. 4. The attacker invokes a command matching one of the passwordless rules, such as `sudo /usr/bin/npx playwright install ...`. 5. `npx` resolves ...[truncated 960 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the documented `NOPASSWD` sudoers rules and delete any deployed copies from `/etc/sudoers.d/`. 2. Do not grant elevated access directly to `npm`, `npx`, Node.js, shells, interpreters, or other general-purpose execution tools. 3. Install required operating-system dependencies once through a trusted administrator using reviewed, distribution-native package commands. 4. Prefer a prebuilt, isolated container image containing the required browser dependencies. 5. If delegated installation is unavoidable, create a root-owned wrapper that: - Uses fixed commands and fixed arguments. - Rejects all user-supplied options and environment variables. - Uses absolute executable and package paths. - Applies a sanitized environment and fixed working directory. - Does not perform dynamic npm package resolution. 6. Require authentication rather than `NOPASSWD` and limit authorization to the shortest practical period. 7. Pin and verify all packages before any privileged installation operation.