T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:100- Finding
Predictable Disk Benchmark File Permits Symlink-Based File Corruption
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 100–103
Vulnerability Type: Predictable temporary file and symlink-following write
Risk Level: HighVulnerable Code
bash cmd_disk() { local dir="${2:-}" [ -z "$dir" ] && die "Usage: $SCRIPT_NAME disk <dir>" dd if=/dev/zero of=${2:-/tmp}/bench_test bs=1M count=100 oflag=direct 2>&1 | tail -1; rm -f ${2:-/tmp}/bench_test }Technical Analysis
The disk benchmark writes 100 MiB of zero bytes to a fixed filename,
bench_test, inside a caller-selected directory. The path is neither created securely nor checked for an existing symbolic link. Becauseddfollows symbolic links when opening its output file, an attacker who can create<directory>/bench_testbefore execution can redirect the write to another file writable by the account running the Skill.The
${2:-/tmp}/bench_testexpansions are also unquoted. This allows shell word splitting and pathname expansion when a directory contains spaces or glob characters, making the command behavior less predictable. The principal exploitable security issue, however, is the predictable path and symlink-following write.Attack Path
- The attacker identifies a directory that the victim will use for the disk benchmark and in which the attacker can create entries.
- The attacker creates
bench_testin that directory as a symbolic link to a target file writable by the victim:bash ln -s /path/to/writable/target /shared/benchmark-directory/bench_test - The victim runs the disk benchmark against that directory.
ddopensbench_test, follows the symbolic link, and writes up to 100 MiB of zero bytes to the target.- The target file is corrupted or destroyed. The subsequent
rmremoves the symbolic link rather than restoring the damaged target.
Impact Assessment
Successful exploitation permits corruption of files writable by the account executing the Skill. Under an ordinary user acc ...[truncated 485 chars]
- Remediation
View remediation
Remediation Suggestions
- Validate that the supplied destination is an existing directory.
- Create a unique benchmark file securely with
mktemp, rather than using a predictable filename. - Quote every path expansion and use
--where supported to terminate option parsing. - Register a cleanup trap so only the exact securely generated file is removed.
- Do not run the benchmark with elevated privileges.
- Prefer a directory owned by the executing user and inaccessible to untrusted users.
- Consider checking that the generated path is a regular file and refusing symbolic links.
Example hardened implementation:
bash cmd_disk() { local dir="${1:-}" local test_file="" [ -n "$dir" ] || die "Usage: $SCRIPT_NAME disk <dir>" [ -d "$dir" ] || die "Not a directory: $dir" test_file="$(mktemp --tmpdir="$dir" benchmark-tool.XXXXXX)" || die "Unable to create benchmark file" trap 'rm -f -- "$test_file"' RETURN dd if=/dev/zero of="$test_file" bs=1M count=100 oflag=direct 2>&1 | tail -1 }Because
mainshifts the command name before callingcmd_disk, the function should consume its directory from${1:-}, not${2:-}.