CLI Baseline B07 - untrusted search path / PATH hijack

cli-baseline-b07-path-hijack is a high severity check in the cli-baseline category, written in shell. Its source is templates/cli-baseline/cli-baseline-b07-path-hijack.sh in cert-x-gen-templates.

What it checks

Prepends a controlled directory of benign shims named for common helper programs to PATH. If the target runs one of them, it is resolving helper names through the caller’s search path.

Header

Field	Value
Id	cli-baseline-b07-path-hijack
Severity	high
Language	shell
Category	cli-baseline
Author	CERT-X-GEN / CLI Security Baseline
Template version	not recorded
Confidence	not recorded
CVSS	not recorded
Weakness	CWE-426
Tags	cli, baseline, path-hijack, cwe-426, cwe-427
Target kind	cli
Oracle	property

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

The file declares @allow_nonzero_exit as well. Those are not tabled above; read the source for what they carry.

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info cli-baseline-b07-path-hijack

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• cli-baseline is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.