Command Path Injection

high Nessus Plugin ID 345664

Synopsis

Finds environment paths that could enable a command injection attack.

Description

This plugin identifies PATH environment variables either at the system or user level that could be leveraged by a local attacker for path based command injection.

Path command injection happens when a PATH places user controlled directories, relative paths or world writable directories ahead of critical system directories. A local low-privilege attacker can then place malicious payloads with names matching system executables in those locations and achieve privilege escalation and possibly complete takeover of the target host.

Solution

Modify the target system's settings to move user controlled directories, relative paths and world-writable directories to a position after system controlled locations in the affected PATH environment variable.

Plugin Details

Severity: High

ID: 345664

File Name: command_path_injection.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: General

Published: 9/14/2026

Updated: 9/14/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: Tenable score based on exploit profile.

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H