T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:6
- Finding
- Personal habit data may be created with permissive filesystem permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 6-9 **Vulnerability Type**: Insecure local data permissions **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${HOME}/.local/share/habithero" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } ``` ### Technical Analysis The application stores personal habit, health, routine, and productivity records under `~/.local/share/habithero`. It creates the data directory and log files without setting a restrictive `umask` or explicitly enforcing filesystem permissions. Consequently, the effective permissions depend on the environment in which the script runs. With a common `022` umask, the directory can be created as mode `755` and log files as mode `644`, making the records readable by other local users who can traverse the user's home directory. This issue applies not only to `history.log`, but also to the command-specific logs and generated export files created elsewhere in the script. ### Attack Path 1. A user runs HabitHero in an environment with a permissive umask, such as `022`. 2. The script creates `~/.local/share/habithero` and its log files without restrictive modes. 3. The user records potentially sensitive habits, health activities, routines, reminders, or reviews. 4. Another account on the same system enumerates the user's accessible home directories. 5. The local account reads the HabitHero logs or exports and obtains the recorded personal information. The attack requires local filesystem access under another account and sufficient permission to traverse the affected user's home directory. ### Impact Assessment The vulnerability can disclose all HabitHero records and exports to unauthorized local users. Exposed information may include personal routines, health-related habits, schedules, reminders, and historical activity. The issue affects confidentiality within the current user's account data. It does not ...[truncated 118 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Establish a restrictive process umask before creating any application data: ```bash umask 077 ``` 2. Create and validate the directory with owner-only permissions: ```bash mkdir -p -m 700 "$DATA_DIR" chmod 700 "$DATA_DIR" ``` 3. Create log and export files with mode `600`. Existing files should also be corrected: ```bash find "$DATA_DIR" -type f -exec chmod 600 {} + ``` 4. Refuse to use the data directory if it is a symbolic link or is owned by another account. 5. Document that HabitHero stores potentially sensitive personal information locally and identify the exact storage location. ]]>