Description

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the `PATH` environment variable. An attacker controlling the execution environment can place malicious executables such as sudo earlier in the `PATH`, resulting in execution of attacker-controlled code. Version 2.0.0 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-07T19:17:47.627Z",
  "pubdate": "2026-08-07T19:17:47.627Z",
  "executiveSummary": "NexTor IP Changer versions prior to 2.0.0 suffer from an arbitrary command execution vulnerability stemming from the unsafe handling of system commands. Specifically, the application invokes underlying operations utilizing `shell=True` combined with commands that depend on executable resolution via the `PATH` environment variable.\nThis architectural flaw allows an adversary who can manipulate the local execution environment to achieve unauthorized code execution with the privileges of the running process. The primary risk implication is local privilege escalation or arbitrary command execution if the application is executed within a compromised or untrusted directory context.\nExploitation requires the attacker to have pre-existing control over the execution environment—specifically the ability to place malicious binaries, such as a spoofed `sudo` executable, earlier in the system's `PATH` variable.\nImpact includes full compromise of the application execution context and potential elevation of privilege depending on how the tool is invoked by the user. Remediation requires upgrading to version 2.0.0 or later, where the unsafe shell invocation mechanism has been addressed.",
  "technicalDetails": "The vulnerability resides in the command-line interface logic of NexTor IP Changer prior to version 2.0.0, where system processes are spawned using Python's subprocess-related mechanisms with `shell=True enabled.\nThe root cause is the reliance on shell evaluation coupled with absolute or relative command resolution that queries the system `PATH` environment variable to locate core binaries like `sudo` or related networking utilities.\nWhen `shell=True` is passed to the execution function, the operating system shell interprets the command string directly. Because the application relies on dynamic executable resolution through `PATH`, it evaluates directory paths sequentially to locate the requested binary.\nAn attacker exploits this behavior by performing a PATH hijacking or binary planting attack. If the attacker has write access to a directory that precedes legitimate system paths in the `PATH` variable, or if the current working directory contains a malicious executable named identically to a targeted command (such as `sudo`), the shell executes the attacker-controlled binary instead of the legitimate system utility.\nThe attack flow proceeds as follows: First, the adversary plants a malicious executable matching a required command name in a directory that is scanned earlier in the `PATH` sequence than the legitimate binary. Second, the user or an automated process triggers NexTor IP Changer. Third, the application initiates a subprocess invocation using `shell=True`. Fourth, the underlying shell resolves the command name to the malicious binary found in the poisoned `PATH`. Finally, the operating system executes the attacker's arbitrary payload within the security context of the NexTor IP Changer process.\nNo network exposure is strictly required as this is a local execution environment vulnerability, though it can be triggered remotely if combined with other vectors that allow file placement and command invocation. Authentication and privilege requirements depend on the victim's execution context, but successful exploitation using binaries like `sudo` can yield elevated privileges.\nAffected versions are all releases prior to version 2.0.0. Version 2.0.0 contains the official fix for this vulnerability."
}