Google released PathAuditor to detect unsafe path access patterns

Google has released the source code of a tool, dubbed PathAuditor, designed to help developers identify vulnerabilities related to file access.

Google decided to release the source code of a tool dubbed PathAuditor designed to help developers identify vulnerabilities related to file access.

PathAuditor has been released by the tech giant as open-source, the company plans to continue to contribute to the development of the tools and with this move aims at involving the security community to improve it. However, it has pointed out that it’s not an officially supported Google product.

“To find issues like this at scale we wrote PathAuditor, a tool that monitors file accesses and logs potential vulnerabilities. PathAuditor is a shared library that can be loaded into processes using LD_PRELOAD. It then hooks all filesystem related libc functions and checks if the access is safe.” reads the post published by Google. “For that, we traverse the path and check if any component could be replaced by an unprivileged user, for example if a directory is user-writable. If we detect such a pattern, we log it to syslog for manual analysis.”

File access vulnerabilities could be exploited by attackers to execute malicious code with elevated privileges, for this reason, Google has released PathAuditor. The tool could be used by developers to detect unsafe path access patterns that could introduce weaknesses.

The tool checks if an unprivileged user could replace a file or directory with a symlink, a scenario that could which can represent a vulnerability.

The source code of the PathAuditor is available on GitHub, the company has also shared an example of a flaw that can be detected with PathAuditor.

“The project is still in the early stages and we are actively working on it. We look forward to hearing about any vulnerabilities you discover with the tool, and hope to see pull requests with further improvements.” concludes Google.

Earlier this year, Google released the ClusterFuzz fuzzing platform that was developed to find memory corruption bugs in the Chrome browser.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – PathAuditor, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]