PATH Hijacking issue in Pacu

[SENSEiXENUS]

• In file main.py, binary clear s executed with os.system() without the path specified e.g /usr/bin/clear or /bin/clear. An attacker can control the PATH environment variable leading to code execution.

#line 687
elif command[0] == 'clear':
    if sys.platform == "win32":
        os.system("cls")
     else:
         os.system("clear")

• Walkthrough-:
• Prepping the path up-:

• Result-:

• Fix-:

os.system('/usr/bin/clear')

[nobodynate]

Hey @SENSEiXENUS, thank you for spending energy on our project.

An attacker can control the PATH environment variable leading to remote code execution.

Exploiting this would require some level of control already; an attacker would need to be on the machine to drop the malicious binary and adjust the PATH right?

[RyanJarv]

On windows I think the current directory is usually on PATH by default.

But a bit confused because the original post shows Linux environment? I’ve never heard of that being default in Linux.

[SENSEiXENUS]

Yeah, it will require some level of control but it might just lead to a privilege escalation issue.