T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/office/soffice.py:24- Finding
Predictable LD_PRELOAD Library Allows Local Tool Hijacking
- Content
View full analysis
dict: env = os.environ.copy() env["SAL_USE_VCLPLUGIN"] = "svp" if _needs_shim(): shim = _ensure_shim() env["LD_PRELOAD"] = str(shim) return env ``` ```python _SHIM_SO = Path(tempfile.gettempdir()) / "lo_socket_shim.so" ``` ```python def _ensure_shim() -> Path: if _SHIM_SO.exists(): return _SHIM_SO src = Path(tempfile.gettempdir()) / "lo_socket_shim.c" src.write_text(_SHIM_SOURCE) subprocess.run( ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], check=True, capture_output=True, ) src.unlink() return _SHIM_SO ``` ### Technical Analysis The code creates or reuses a shared object at the globally predictable path `/tmp/lo_socket_shim.so`. If that path already exists, the code accepts it without verifying its ownership, permissions, file type, integrity, or contents. When Unix-domain sockets are unavailable, the existing file is assigned to `LD_PRELOAD`. The operating system loader will consequently load that library into the LibreOffice process before normal libraries. A malicious shared object can execute arbitrary native code through a constructor function as soon as LibreOffice starts. The source file `/tmp/lo_socket_shim.c` and compiler output are also predictable, introducing race conditions and symlink-replacement opportunities. ### Attack Path 1. A local attacker with access to the shared temporary directory creates `/tmp/lo_socket_shim.so` containing malicious native code. 2. The Skill runs in an environment where `_needs_shim()` returns `True`. 3. `_ensure_shim()` observes that the predictable file exists and returns it without validation. 4. `get_soffice_env()` sets `LD_PRELOAD` to the att ...[truncated 635 chars]- Remediation
View remediation