1

If an attacker can set environment variables at will, what attacks can be performed using this advantage, and what degree of control can the attacker take?

closed as too broad by Bryan Field, S.L. Barth, techraf, Stephane, Matthew Sep 19 '16 at 15:56

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • From the war games I played, I don't know if this is still possible (it was long ago), an environment variable could be used to avoid stack overflow protections, so redirecting the code to variable's address may spawn a shell. – YoMismo Sep 19 '16 at 13:25
  • 2
    The obvious one is PATH. If I type a simple command such as ls within a compromised environment, then any malicious program can be executed. If I use only absolute paths such as /usr/bin/ls then PATH no longer takes effect. – Bryan Field Sep 19 '16 at 13:44
  • 2
    You should limit the scope if your question. 'what attacks' is a seemingly endless list. Perhaps asking for an example attack so we can know easily whether your question is answered. – Bryan Field Sep 19 '16 at 13:46
2

What about LD_LIBRARY_PATH on Unix/Linux or PATH on Windows? If I manage to get a malicious notepad.exe into C:\windows\temp, I can add this path as first element in the PATH and the malicious file will be executed instead of the real one.

  • Good point, I was thinking more in terms of server processes. – Julian Knight Sep 19 '16 at 13:36
  • 1
    Then replace notepad.exe by sth that is called frequently on a server... – kaidentity Sep 19 '16 at 13:43
1

This is really rather too broad a question for a direct answer.

It depends a lot on the OS and other applications that may be in use. Many applications may take some level of configuration from environment variables.

For example, many node.js applications will take a variable that determines whether it runs in a production or development mode. If an attacker can force it into development mode, the attacker may be able to find out information not presented in production mode.

However, I would have thought that there are far easier attacks. If someone has sufficient access to change environment variables, they may well have other access too.

Not the answer you're looking for? Browse other questions tagged or ask your own question.