T09 · Insecure Skill Coding Practices
Warning
- Location
- evals/run_evals.py:7
- Finding
- Python Path Injection Enables Arbitrary Code Execution from an Untrusted Temporary Directory## Vulnerability Details **File Location**: `evals/run_evals.py`, lines 7–10 **Vulnerability Type**: Python module search-path injection from an external, writable directory **Risk Level**: Medium **Vulnerable Code:** ```python REPO_ROOT = Path(__file__).resolve().parent.parent.parent.parent sys.path.insert(0, str(REPO_ROOT / "shared")) from eval_framework import main ``` ### Technical Analysis The script derives `REPO_ROOT` by traversing four parent directories from `evals/run_evals.py`. At the audited project location, this resolves to `/tmp`, causing `/tmp/shared` to be inserted at index zero of `sys.path`. Python searches `sys.path` in order when resolving imports. Consequently, `from eval_framework import main` loads an `eval_framework.py` file or `eval_framework` package from `/tmp/shared` before checking lower-priority trusted locations. Because this path is outside the audited project and is located beneath a predictable temporary directory, another local user or process may be able to populate it with attacker-controlled Python code. Importing a Python module executes its top-level statements immediately. The attacker therefore does not need to provide a valid evaluator implementation to obtain code execution. ### Attack Path 1. An attacker gains write access to `/tmp/shared`, or creates that directory where local permissions allow it. 2. The attacker creates `/tmp/shared/eval_framework.py` containing malicious top-level Python code and a compatible `main` symbol if execution must continue without an obvious error. 3. A user runs: ```bash python evals/run_evals.py ``` 4. The script prepends `/tmp/shared` to `sys.path`. 5. Python resolves `eval_framework` from the attacker-controlled path. 6. The malicious module's top-level code executes with the identity and environment of the user running the evaluation. ### Impact Assessment Successful exploitation provides arbitrary Python code e ...[truncated 539 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the predictable temporary directory from `sys.path`. 2. Package `eval_framework` as a pinned, trusted dependency and import it through the normal Python environment. 3. If the framework must be repository-local, derive its location from a verified project marker rather than a fixed number of parent traversals. 4. Resolve the candidate directory and confirm it is contained within the expected trusted repository root before modifying `sys.path`. 5. Reject symbolic links and directories that are writable by untrusted users. 6. Run evaluations in an isolated virtual environment with a minimal dependency set and restricted filesystem permissions. 7. Add a startup assertion such as: ```python trusted_root = Path(__file__).resolve().parents[1] shared_dir = (trusted_root / "shared").resolve() if trusted_root not in shared_dir.parents: raise RuntimeError("Refusing to import from outside the trusted project root") ``` The exact path should be adapted to the intended repository structure. 8. Add an automated test that confirms the imported `eval_framework.__file__` resolves inside an approved directory.