T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:294
- Finding
- Passwordless Root Execution Through Broad npx Sudoers Rules## Vulnerability Details **File Location**: `SKILL.md`, lines 294-301 **Vulnerability Type**: Excessive privileges through persistent passwordless sudo authorization **Risk Level**: High **Vulnerable Code**: ```bash ## Sudoers Setup For Playwright browser installation: # /etc/sudoers.d/playwright username ALL=(root) NOPASSWD: /usr/bin/npx playwright install-deps * username ALL=(root) NOPASSWD: /usr/bin/npx playwright install * ``` ### Technical Analysis The documented sudoers configuration grants an unprivileged account persistent, passwordless permission to run broadly parameterized `npx playwright install` and `install-deps` commands as root. The wildcard suffix permits uncontrolled additional arguments, while `npx` introduces package resolution and package-managed execution into a privileged trust boundary. Elsewhere, the installation guidance uses `npm install -g playwright` without pinning or verifying a specific package version. If package resolution, the npm environment, the installed Playwright package, or its installer behavior is compromised, the authorized command can execute that behavior with root privileges. This violates least privilege because browser dependency installation does not require an ongoing passwordless root capability after setup. ### Attack Path 1. A user follows the documentation and creates `/etc/sudoers.d/playwright` with the supplied rules. 2. The designated unprivileged account gains persistent permission to invoke the allowed `npx playwright` installation commands as root without authentication. 3. An attacker who controls that account, its npm configuration or resolution environment, or a package component reached by the authorized command prepares compromised package or installer behavior. 4. The attacker invokes an authorized command with `sudo`, including any permitted wildcard arguments. 5. The package-managed installation logic executes in the root security context. 6. T ...[truncated 817 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the proposed persistent `NOPASSWD` sudoers rules. 2. Install required operating-system dependencies once through an administrator-controlled provisioning process rather than granting the automation account ongoing elevation. 3. Pin Playwright to an explicitly reviewed version and use a lockfile or other integrity controls where applicable. 4. Avoid running `npx` as root because it combines package resolution and execution in a privileged context. 5. If elevation is operationally unavoidable, create a root-owned, non-writable wrapper that invokes a trusted absolute executable with a fixed package version and fixed arguments. 6. Authorize only that wrapper in sudoers, without wildcard arguments, arbitrary environment preservation, or user-controlled paths. 7. Validate the sudoers policy with `visudo`, restrict the entry to the minimum required account and host, and remove it immediately after provisioning. 8. Perform browser installation in an isolated container or prebuilt image where possible, limiting any compromise to a disposable environment.