theshit vulnerable to unsafe loading of user-owned Python rules when running as root

The vulnerability stems from the application's failure to properly validate the ownership and permissions of custom Python rules and configuration files loaded from user-writable locations, such as ~/.config/theshit/. When the application is executed with elevated privileges (e.g., using sudo), it continues to trust these files, even if they originate from an unprivileged user. This allows a local attacker to inject arbitrary Python code into the application's execution context, effectively gaining control over the system. The potential impact includes complete system compromise, data exfiltration, and the installation of persistent malware. This vulnerability shares similarities with other LPE exploits that leverage insecure file handling and privilege escalation.

Users of theshit who are running versions prior to 0.1.1 and have configured the application to load custom Python rules or configuration files from user-writable locations are at significant risk. This includes developers and system administrators who have customized the application's behavior or deployed it in environments with shared user accounts.

• linux / server:

find ~/.config/theshit/ -type f -perm -002 -print

• linux / server:

journalctl -u theshit | grep -i "python rule"

• generic web:

curl -I http://localhost/theshit/ | grep 'Content-Type' # Check for unexpected content types

1. 2025-12-30Disclosure

   disclosure

1. 已保留2025-12-30
2. 发布日期2025-12-30
3. 修改日期2026-02-03
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-69257 is to upgrade to version 0.1.1 or later, which includes the necessary security fixes. If upgrading is not immediately feasible, consider restricting write access to the ~/.config/theshit/ directory to only the application's user account. Implement strict input validation for all configuration files, ensuring that they do not contain any executable code. Consider using a Web Application Firewall (WAF) or proxy to inspect and filter traffic to the application, blocking requests containing potentially malicious payloads. After upgrading, confirm the fix by attempting to load a known malicious configuration file and verifying that it is rejected or sandboxed.