[ASU] First Attack

[seunghakbae]

Version: commit 9ed22e0

Environment : static analysis tools

Location of vulnerability : REGO_main.py:171

Types of vulnerability : start_process_with_partial_path

Explanation of vulnerability :
Python possesses many mechanisms to invoke an external executable. If the desired executable path is not fully qualified relative to the filesystem root then this may present a potential security risk. In POSIX environments, the PATH environment variable is used to specify a set of standard locations that will be searched for the first matching named executable. While convenient, this behavior may allow a malicious actor to exert control over a system. If they are able to adjust the contents of the PATH variable, or manipulate the file system, then a bogus executable may be discovered in place of the desired one. This executable will be invoked with the user privileges of the Python process that spawned it, potentially a highly privileged user.

[SecOfSW]

First of all, thank you for opening the issue.
In our investigation of what you mentioned, we concluded that this code is vulnerable.

We will patch and add a comment about this issue further.

If you have any other opinion of this issue, feel free to add comments below. Thank you.

[SecOfSW]

Patch Report

• Commit ID : 0f25cec
• Cause of vulnerability : not fully qualified path of program to execute is given to os.system() function

os.system("explorer.exe reg.diff")

We expected this code to execute windows file explorer. However, if there is binary file named explorer.exe in the same directory, it would be executed instead of windows file explorer. Because the current directory is always searched before the PATH is used.

• Explanation : We changed os.system() function to os.startfile() function. os.startfile() function searches only the PATH