If an attacker can set environment variables at will, what attacks can be performed using this advantage, and what degree of control can the attacker take?
closed as too broad by Bryan Field, S.L. Barth, techraf, Stephane, Matthew Sep 19 '16 at 15:56
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
What about LD_LIBRARY_PATH on Unix/Linux or PATH on Windows? If I manage to get a malicious notepad.exe into C:\windows\temp, I can add this path as first element in the PATH and the malicious file will be executed instead of the real one.
This is really rather too broad a question for a direct answer.
It depends a lot on the OS and other applications that may be in use. Many applications may take some level of configuration from environment variables.
For example, many node.js applications will take a variable that determines whether it runs in a production or development mode. If an attacker can force it into development mode, the attacker may be able to find out information not presented in production mode.
However, I would have thought that there are far easier attacks. If someone has sufficient access to change environment variables, they may well have other access too.