T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/scan_drives.py:21- Finding
Caller-Controlled PATH Can Select an Executable That Is Subsequently Run Through sudo
- Content
View full analysis
Vulnerability Details
File Location:
scripts/scan_drives.py, lines 21–32 and 108–116
Vulnerability Type: Privilege escalation through unsafe executable resolution
Risk Level: HighVulnerable Code
python def find_smartctl(): """Return path to smartctl or None if not found.""" candidates = [ shutil.which("smartctl"), "/usr/local/sbin/smartctl", "/opt/homebrew/sbin/smartctl", "/usr/sbin/smartctl", ] for path in candidates: if path and Path(path).exists(): return path return Nonepython def run_smartctl(device, smartctl_path, use_sudo=False): """Run smartctl -a on a device. Returns (output_str, error_str).""" cmd = [] if use_sudo: cmd.append("sudo") cmd += [smartctl_path, "-a", device] try: result = subprocess.run( cmd, capture_output=True, text=True, timeout=30 )Technical Analysis
find_smartctl()gives precedence toshutil.which("smartctl"), which searches the caller-controlledPATH. The selected path is accepted merely when it exists; the code does not verify that it is a regular trusted executable, is owned by a privileged account, or is not writable by an untrusted user.When the documented
--sudooption is enabled,run_smartctl()passes that resolved path tosudo. Although the use of an argument array prevents shell metacharacter injection, it does not prevent executable substitution. An attacker who controls the environment or can place a malicioussmartctlin an earlierPATHdirectory can cause their program to be selected and offered for privileged execution.The attack still depends on the applicable sudo policy or a user successfully authorizing the sudo prompt. It is therefore not an authentication bypass by itself, but it creates an unsafe privilege boundary in the documented elevated workflow.
Attack Path
- The attacker creates an executable nam ...[truncated 1167 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not use a caller-controlled
PATHto resolve an executable that will be run throughsudo. - Under
--sudo, select only explicit trusted installation paths appropriate to the operating system, such as/usr/sbin/smartctl, after validation. - Validate the selected path with
Path.resolve()andstat():- Require a regular file.
- Reject symbolic links where practical.
- Require ownership by root or another explicitly trusted administrator.
- Reject files writable by group or other users.
- Avoid trusting
/usr/localor Homebrew paths for privileged execution unless their complete directory chain and file ownership are verified. - Run with a sanitized environment and an explicit safe
PATH, for example by using an administrative wrapper with a tightly scoped sudoers rule. - Prefer granting only the minimum capability necessary to a verified
smartctlbinary rather than elevating an executable selected by application logic. - If no trusted binary passes validation, stop with an error instead of falling back to
shutil.which(). - Add tests that place a fake
smartctlfirst inPATHand verify that elevated mode rejects it.
- Do not use a caller-controlled