T07 · Tool Hijacking and Spoofing
- Location
runner.py:12- Finding
Unverified External Interpreter and Task Scripts Can Be Hijacked
- Content
View full analysis
Vulnerability Details
File Location:
runner.py, lines 12–30
Vulnerability Type: Local tool and executable hijacking
Risk Level: HighVulnerable Code
python HOME_DIR = os.path.expanduser("~") VENV_PYTHON = os.path.join(HOME_DIR, "quant_trading", "venv", "bin", "python3") PROJECT_DIR = os.path.join(HOME_DIR, "quant_trading") def run_quant_script(task_num, script_name, args): """Execute a quantitative module script.""" try: script_path = os.path.join(PROJECT_DIR, task_num, script_name) if not os.path.exists(script_path): return {"status": "error", "error": f"Script does not exist: {script_path}"} # Construct the execution command cmd = [VENV_PYTHON, script_path] + args # Execute with a two-minute timeout result = subprocess.run( cmd, capture_output=True, text=True, timeout=120, cwd=PROJECT_DIR )Technical Analysis
The runner executes a Python interpreter and task scripts located under the external, user-home directory
~/quant_trading. These executable components are not included in the audited package.Before execution, the code only verifies that the selected task-script path exists. It does not verify the canonical path, file type, ownership, permissions, symlink status, cryptographic hash, or signature of either the script or the virtual-environment interpreter. The package therefore cannot guarantee that the invoked files are the intended quantitative-trading components.
Although
subprocess.runreceives an argument array and does not use a shell, preventing direct shell metacharacter injection through forwarded arguments, that safeguard does not prevent replacement or spoofing of the executable files themselves.Attack Path
- An attacker obtains the ability to write to the Agent user's
~/quant_tradingdir ...[truncated 1555 chars]
- An attacker obtains the ability to write to the Agent user's
- Remediation
View remediation
Remediation Suggestions
- Bundle the task scripts within the Skill package and resolve their locations relative to the trusted
runner.pyfile rather than the user's home directory. - Use a trusted Python interpreter supplied by the execution environment instead of an interpreter located in a mutable project directory.
- If external components are required, maintain an explicit allowlist of expected canonical paths and verify that every resolved path remains within the approved root.
- Reject symbolic links and require regular files for both the interpreter and task scripts.
- Verify trusted ownership and restrictive permissions. Refuse execution when files or parent directories are writable by unauthorized users or groups.
- Validate task scripts and executable components against pinned cryptographic hashes or trusted digital signatures immediately before execution.
- Keep the existing fixed task-to-script mapping and argument-array invocation; do not introduce shell-based command construction.
- Execute quantitative modules in a sandbox with minimal filesystem, credential, network, and operating-system permissions.
- Include all security-relevant task implementations in the review and release process so that the distributed package accurately represents the code executed at runtime.
- Bundle the task scripts within the Skill package and resolve their locations relative to the trusted