Hacker News Reader

Hacker News

Comment by x3n0ph3n3 | Hacker News Reader

Parent Full thread

x3n0ph3n3

Same thing happens if I have a:

1) PS1 that displays the current git branch

2) Include the current directory in my PATH

Should we file a high severity CVE with bash now?

View on HN

It’s been known for decades that you should never put your current directory in your PATH. There are endless opportunities for vulnerabilities then. I learned this in college in the 80’s (by not following it and getting owned).

Yet PowerShell does it by default.

I don't think it does?

   > cd C:\Temp
   > copy "C:\Program Files\Git\bin\git.exe" .\fred.exe
   > fred
   fred: The term 'fred' is not recognized as a name of a cmdlet, function, script file, or executable program.
   Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

If bash placed the current directory in your PATH by default, then yes.

Could file a CVE with Microsoft then, cause thats kinda what cmd.exe is doing:

    > git clone git://evil evil
    > cd evil\
    > git status

The last line would execute git.exe from the cloned repo, wouldn't it?

No, `git` uses the binary in path, to use the repo file it should be `./git.exe`

On Linux.

Look for `NoDefaultCurrentDirectoryInExePath` if you want to learn about Windows.

I would file a CVE for any program that places untrusted content into PATH and invokes non-fully qualified executable names - not for the shell.

Not with bash. If your distro is putting ./ into the path then that's absolutely a high severity CVE with your distro's config.

Reply on news.ycombinator.com