T07 · Tool Hijacking and Spoofing
Error
- Location
- scripts/run_doctor.py:8
- Finding
- Untrusted Python Module Loading in Doctor Wrapper## Vulnerability Details **File Location**: `scripts/run_doctor.py`, lines 8–13 **Vulnerability Type**: Untrusted module path injection and local tool hijacking **Risk Level**: High **Vulnerable Code**: ```python ROOT = Path(__file__).resolve().parents[3] SRC = ROOT / "src" if str(SRC) not in sys.path: sys.path.insert(0, str(SRC)) from workspace_doctor.cli import main ``` ### Technical Analysis The wrapper derives its source directory using `Path(__file__).resolve().parents[3]`. In the supplied project location, this resolves to `/tmp`, causing `SRC` to resolve to `/tmp/src` rather than a directory contained in the audited project. The code then inserts `/tmp/src` at the beginning of `sys.path`, giving modules in that directory precedence over installed or otherwise trusted Python packages. The imported `workspace_doctor.cli` implementation is not included in the audited project, so the wrapper's effective executable behavior cannot be verified from the package. This creates a Python module preloading vulnerability. A local attacker who can establish `/tmp/src/workspace_doctor/cli.py` can substitute an attacker-controlled implementation for the expected doctor tool. Importing that module executes its top-level code immediately, even before the wrapper calls `main()`. ### Attack Path 1. An attacker creates a Python package at `/tmp/src/workspace_doctor`. 2. The attacker adds a malicious `cli.py` exporting a compatible `main` function or executing code during import. 3. A user or AI Agent runs `scripts/run_doctor.py`. 4. The wrapper prepends `/tmp/src` to `sys.path`. 5. Python resolves `workspace_doctor.cli` from the attacker-controlled directory. 6. The malicious module executes with the permissions and environment of the invoking user. ### Impact Assessment Successful exploitation provides arbitrary Python code execution with the privileges of the user or Agent running the wrapper. The attacker could ...[truncated 423 chars]
- Remediation
- ## Remediation Suggestions - Package `workspace_doctor` inside the audited project and import it through the normal Python packaging mechanism. - Do not prepend shared or externally controlled directories such as `/tmp/src` to `sys.path`. - Derive repository-relative paths from a clearly defined project root rather than using a fixed parent depth. - Prefer installing the package into an isolated virtual environment and invoking a declared console entry point. - If dynamic path loading is unavoidable, verify that the target directory: - Is located within the expected project root. - Is not a symbolic link escaping that root. - Is owned by the expected user. - Is not writable by untrusted users. - Contains the expected, integrity-verified package files. - Fail closed with a clear error when the bundled implementation cannot be found instead of searching a shared external path. - Add tests asserting that the resolved import path remains inside the project directory.