Vulnerable code sample

#!/usr/bin/env python3

import os
import sys
import pwd

# The name of the application, used for configuration paths.
APP_NAME = 'theshit'

def get_user_config_dir():
    """
    Determines the configuration directory based on the executing user.
    This is the core of the vulnerability. When run with sudo, it uses the
    original user's home directory, not root's.
    """
    try:
        # If 'sudo' is used, SUDO_USER will be set to the original user's name.
        original_user = os.environ.get('SUDO_USER')
        if original_user:
            # Get home directory of the original user.
            home_dir = pwd.getpwnam(original_user).pw_dir
        else:
            # Not running under sudo, so use the current user's home directory.
            home_dir = os.path.expanduser('~')

        return os.path.join(home_dir, '.config', APP_NAME)
    except Exception:
        # Fallback in case of any errors (e.g., user not found)
        return None


def load_custom_rules(config_dir):
    """
    Loads and executes custom Python rules from the user's rules directory.
    This function does not validate file ownership or permissions, leading
    to arbitrary code execution when run with elevated privileges.
    """
    rules_dir = os.path.join(config_dir, 'rules')
    if not os.path.isdir(rules_dir):
        return

    print(f"[*] Loading custom rules from: {rules_dir}", file=sys.stderr)

    for rule_file in os.listdir(rules_dir):
        if rule_file.endswith('.py'):
            rule_path = os.path.join(rules_dir, rule_file)
            try:
                with open(rule_path, 'r') as f:
                    rule_code = f.read()
                    # Execute the Python code from the rule file.
                    # If this script is run as root, this code also runs as root.
                    print(f"    -> Executing rule: {rule_file}", file=sys.stderr)
                    exec(rule_code, {'__file__': rule_path})
            except Exception as e:
                print(f"[!] Error loading rule {rule_file}: {e}", file=sys.stderr)


def main():
    """
    Main function for the 'theshit' application.
    """
    print(f"--- TheShit Auto-Fixer (Vulnerable Version) ---")
    print(f"Effective UID: {os.geteuid()}")

    user_config_dir = get_user_config_dir()

    if not user_config_dir:
        print("[!] Could not determine user configuration directory. Aborting.", file=sys.stderr)
        sys.exit(1)

    # In the vulnerable version, custom rules are loaded without any checks.
    load_custom_rules(user_config_dir)

    print("\n[*] Simulating command analysis...")
    # In a real application, command correction logic would be here.
    print("[*] Analysis complete. No mistakes found.")
    print("---------------------------------------------")


if __name__ == "__main__":
    # To test the vulnerability:
    # 1. Create the necessary directories:
    #    mkdir -p ~/.config/theshit/rules
    # 2. Create a malicious rule file with payload:
    #    echo 'import os; os.system("touch /tmp/pwned_by_theshit")' > ~/.config/theshit/rules/malicious_rule.py
    # 3. Run this script with sudo:
    #    sudo python3 /path/to/this_script.py
    # 4. Check for the created file:
    #    ls /tmp/pwned_by_theshit
    #    The file will be owned by root, demonstrating successful privilege escalation.
    main()