seamusabshere/unix_utils — Issue #3: Relying on PATH to find executables is a security hole.
Author: vampirechicken
Created: 2012-03-05 15:03:30+00:00
State: open

Use full paths to executables.

If you don't provide a full path to the executable, you execute the first one on the path.

$ cat < /tmp/head
echo 'Problem?'
EOF
$chmod +x /tmp/head
$ export PATH=/tmp:$PATH

Now run a program that calls 'head' instead of '/full/path/to/head

You'll run /tmp/head.

If you combine this with setuid/setgid, you have an escalation of privileges waiting to happen.

See also: [level one of Stripe Capture the Flag] (https://stripe.com/blog/capture-the-flag)