I noticed that some folders in the PATH environment variable (e.g. C:\Python) give write privileges to anyone on the machine, including users without Admin rights. I understand that people can probably modify the Python executables and things in that folder. However, how dangerous is it if I don't use Python? Also, since most programs on Windows are called either through GUI or with absolute paths, could this issue still affect other more sensitive folders in PATH such as System32?
How dangerous is it if I don't use Python?
Your usage of Python is irrelevant to the risk.
The PATH variable provides a means to invoke programs without having to type in their full path. While Unix people would consider putting a publicly writable directory (or .) in the PATH variable a cardinal sin. The risk is that an attacker can substitute the program a user intends to run with their own evil code and thereby trick the victim into running it.
On MS Windows the risk is lower but its more difficult to mitigate:
- most people don't use command lines in MS Windows
- usually programs are started from the explorer which uses a full path to the executable
- MS Windows always searches the current directory first before checking in %PATH% for an executable (i.e. the risk is baked into MS Windows by design)
Disclaimer: OP's question is explicitely for Windows, so this answer only focuses on this system. For an Unix or Unix-like system the answer would be different.
The problem is not really that some folders in PATH are writable by anyone. The PATH is only a list of folders from which you can start a command with a simple name and not a full path.
But the fact that folders containing commands, be them in PATH or not, are writable by anyone is a security risk.
If the machine has no server service active, and if it is physically secured with only one single user, the risk may be acceptable: if you erase/rewrite a system file or any other executable, you should know why and nobody else than you can be to blame. But anyway best practices (as dicted by Windows) recomment that you are warned before doing a potentially dangerous task, so system folders should require admin privileges to be writable.
But if more than one person (administrators are not included here) can access the machine, then it becomes a serious security problem. One could voluntarily or not replace an executable or a DLL, and another one could launch an unwanted program when executing a Python script. Not speaking if System32 is publicly writable because any action could lead to unexpected results.
TL/DR: unless you are the only user of the machine, the Python folder should not be writable by all but should require admin priviledge.
On a Unix or Unix-like system, the problem will be different. First default installations normally never make folders containing executable publicly writable and the PATH is heavily used. So of course having a folder in PATH publicly writable would be per se a serious security problem. But Windows comes with different usages...
Yes, it can be a security risk if the proper GPO protections against running foreign executables are not in place (which is a grave security risk in itself).
By swapping out one PATH folder for another, you can trick a user into running a different executable than what they are trying to run. However if you have sensible GPO policies in place the most this would do is cause the user to annoy tech support for a few minutes because 'their' program won't run. And that's IF they are using batch scripts or commandline. Most users do not.