T09 · Insecure Skill Coding Practices
Error
- Location
scripts/collect-baseline.sh:7- Finding
Privileged Arbitrary File Overwrite Through Symlinked Output Files
- Content
View full analysis
&2; } # ---- System information ---- info "Collecting system information..." { echo "=== System distribution ===" cat /etc/openEuler-release 2>/dev/null || cat /etc/os-release 2>/dev/null || echo "N/A" ``` The block is subsequently written using a predictable filename: ```bash } > "$OUTPUT_DIR/system-info.txt" ``` The same pattern is used for numerous other files throughout the script, including `packages.txt`, `fstab.txt`, `sudo.txt`, and `cron-jobs.txt`. ### Technical Analysis The script is explicitly intended to run with `sudo`, but it accepts an arbitrary output directory from the invoking user. `mkdir -p` permits that directory to exist already and does not validate its owner, permissions, or contents. Shell output redirection follows symbolic links by default. Consequently, if an attacker can pre-create the selected directory and place a symbolic link at one of the predictable output paths, the root shell running this script will open and truncate the symlink target. Quoting `$OUTPUT_DIR` prevents shell word splitting but does not protect against filesystem link attacks. The script does not use a restrictive creation policy, reject existing output directories, check for symbolic links, or open files with no-follow semantics. ### Attack Path 1. A local unprivileged attacker creates a directory that the attacker controls. 2. The attacker creates a symbolic link using one of the predictable report filenames, for example: ```bash mkdir -p /tmp/prepared-baseline ln -s /etc/target-file /tmp/prepared-baseline/system- ...[truncated 1499 chars]- Remediation
View remediation
&2 exit 1 fi ``` 3. If existing directories must be supported, verify that the directory is owned by the effective privileged user, is not writable by group or others, and is not a symbolic link. 4. Reject every output path that already exists, including symbolic links: ```bash output="$OUTPUT_DIR/system-info.txt" if [[ -e "$output" || -L "$output" ]]; then echo "Refusing an existing output path: $output" >&2 exit 1 fi ``` 5. Prefer secure file creation with exclusive and no-follow semantics. A small helper implemented in a language exposing `O_CREAT | O_EXCL | O_NOFOLLOW`, or a securely created private temporary directory, is safer than ordinary shell redirection. 6. Canonicalize and constrain caller-supplied destinations where operationally possible. For automated execution, use a fixed root-owned report directory that unprivileged users cannot modify. 7. Add regression tests that create symlinks for every predictable report filename and confirm the script refuses to run without altering the link target. ]]>