T09 · Insecure Skill Coding Practices
- Location
scripts/clawhub_publish_safe.sh:35- Finding
Predictable Temporary Files Permit Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
scripts/clawhub_publish_safe.sh, lines 35–36
Vulnerability Type: Insecure temporary-file handling
Risk Level: MediumVulnerable Code
bash if ! clawhub whoami >/tmp/clawhub_publish_whoami.out 2>/tmp/clawhub_publish_whoami.err; then echo "ERROR: Not logged in. Run: clawhub login --token <clh_token>" >&2Technical Analysis
The script redirects standard output and standard error to fixed, globally predictable paths under
/tmp. It neither creates these files securely nor verifies that they are regular files rather than symbolic links.On systems where
/tmpis shared among users, a local attacker can create either expected path as a symbolic link before the wrapper runs. Shell redirection occurs beforeclawhub whoamiexecutes and follows symbolic links, so the linked destination is opened with truncation enabled.The files are also not deleted after execution. Consequently, output from
clawhub whoamior related diagnostics may remain accessible according to the process umask and filesystem permissions.Attack Path
- A local attacker predicts the fixed paths:
/tmp/clawhub_publish_whoami.out/tmp/clawhub_publish_whoami.err
- The attacker creates one of these paths as a symbolic link to a file writable by the victim account.
- The victim invokes
scripts/clawhub_publish_safe.sh. - During shell redirection, the victim process follows the attacker-controlled symbolic link.
- The target file is truncated and receives output from
clawhub whoami. - Depending on the selected target and victim privileges, this can corrupt user or system data and cause denial of service.
Impact Assessment
Successful exploitation does not directly grant new privileges, but it allows an attacker to misuse the invoking account’s existing file-write permissions. The scope is limited to files writable by that account. If the script is run by a privileged user, the impact may exte ...[truncated 233 chars]
- A local attacker predicts the fixed paths:
- Remediation
View remediation
Remediation Suggestions
If the command output is unnecessary, avoid temporary files:
bash if ! clawhub whoami >/dev/null 2>&1; then echo "ERROR: Not logged in. Run: clawhub login --token <clh_token>" >&2 exit 4 fiIf diagnostic output must be retained:
- Create a private temporary directory with
mktemp -d. - Apply restrictive permissions with
umask 077. - Store output only inside that directory.
- Register a cleanup trap to remove it on every exit path.
- Quote all generated paths.
Example:
bash umask 077 TMP_DIR="$(mktemp -d)" || exit 1 trap 'rm -rf -- "$TMP_DIR"' EXIT if ! clawhub whoami >"$TMP_DIR/whoami.out" 2>"$TMP_DIR/whoami.err"; then cat "$TMP_DIR/whoami.err" >&2 echo "ERROR: Not logged in. Run: clawhub login --token <clh_token>" >&2 exit 4 fiAvoid fixed names in shared temporary directories and do not attempt to repair this solely with a pre-execution existence check, because that would remain susceptible to time-of-check/time-of-use races.
- Create a private temporary directory with