1031
• The program finds the attacker's malicious program, "/my/dir/ls". It doesn't find "/bin/ls" because PATH does not
contain "/bin/".
• The program executes the attacker's malicious program with the raised privileges.
Example 2:
This code prints all of the running processes belonging to the current user.
Example Language: PHP (Bad)
//assume getCurrentUser() returns a username that is guaranteed to be alphanumeric (avoiding CWE-78)
$userName = getCurrentUser();
$command = 'ps aux | grep ' . $userName;
system($command);
If invoked by an unauthorized web user, it is providing a web page of potentially sensitive
information on the underlying system, such as command-line arguments (CWE-497). This program
is also potentially vulnerable to a PATH based attack (CWE-426), as an attacker may be able to
create malicious versions of the ps or grep commands. While the program does not explicitly raise
privileges to run the system commands, the PHP interpreter may by default be running with higher
privileges than users.
Example 3:
The following code is from a web application that allows users access to an interface through
which they can update their password on the system. In this environment, user passwords can
be managed using the Network Information System (NIS), which is commonly used on UNIX
systems. When performing NIS updates, part of the process for updating passwords is to run a
make command in the /var/yp directory. Performing NIS updates requires extra privileges.
Example Language: Java (Bad)
...
System.Runtime.getRuntime().exec("make");
...
The problem here is that the program does not specify an absolute path for make and does not
clean its environment prior to executing the call to Runtime.exec(). If an attacker can modify the
$PATH variable to point to a malicious binary called make and cause the program to be executed
in their environment, then the malicious binary will be loaded instead of the one intended. Because
of the nature of the application, it runs with the privileges necessary to perform system operations,
which means the attacker's make will now be run with these privileges, possibly giving the attacker
complete control of the system.
Observed Examples
Reference Description
CVE-1999-1120 Application relies on its PATH environment variable to find and execute
program.
https://www.cve.org/CVERecord?id=CVE-1999-1120
CVE-2008-1810 Database application relies on its PATH environment variable to find and
execute program.
https://www.cve.org/CVERecord?id=CVE-2008-1810
CVE-2007-2027 Chain: untrusted search path enabling resultant format string by loading
malicious internationalization messages.
https://www.cve.org/CVERecord?id=CVE-2007-2027
CVE-2008-3485 Untrusted search path using malicious .EXE in Windows environment.
https://www.cve.org/CVERecord?id=CVE-2008-3485
CWE Version 4.14
CWE-426: Untrusted Search Path
CWE-426: Untrusted Search Path