Which of the following is a reason environmental variables are a concern when reviewing potential system vulnerabilities?

Environmental variables are a security concern because they store configuration data that can be accessed or modified by a running process. If an attacker exploits a vulnerability, they can read these variables to discover sensitive information like API keys, database credentials, or system paths. They can also manipulate variables, such as PATH or LDLIBRARYPATH, to trick the application into executing malicious code or loading a malicious library. This manipulation directly alters the behavior of the compromised application, thereby expanding the scope and increasing the impact of the initial exploit, potentially leading to privilege escalation or lateral movement.

B. While variables can be overwritten to influence execution flow (e.g., pointing to a malicious library), they do not typically store the malicious code itself.

C. System-wide cryptographic standards are generally defined in dedicated configuration files or are hardcoded, not set through environmental variables.

D. System update schedules are controlled by dedicated services like cron, systemd, or the Windows Update service, not by environmental variables.

---

1. Carnegie Mellon University

Software Engineering Institute

CERT C Coding Standard.

Reference: ENV33-C. Do not call system().

Details: This standard explains that the system() function is vulnerable because it uses the value of the PATH environment variable to locate executables. An attacker can modify PATH to point to a malicious program

causing it to be executed instead of the intended one. This demonstrates how the contents of an environmental variable directly affect the impact of a vulnerability.

2. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Reference: Lecture 5: Controlling Untrusted Code

Section 3.

Details: The lecture notes discuss how the environment of a process can be manipulated to subvert its execution. Specifically

it mentions the LDPRELOAD environment variable on Linux

which can be set to force a program to load a user-specified library first. An attacker can use this to inject their own code into a vulnerable process

escalating the impact of an exploit.

3. The Open Web Application Security Project (OWASP) Cheat Sheet Series.

Reference: OS Command Injection Defense Cheat Sheet.

Details: The document discusses how command injection vulnerabilities arise when an application incorporates untrusted data into a command string. While not exclusively about environmental variables

it notes that the "environment in which the application runs" can influence the outcome of such attacks

reinforcing the principle that environmental context (including variables) affects vulnerability impact.