T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Business data files inherit potentially permissive filesystem permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` Category-specific data is similarly written without establishing restrictive permissions, for example: ```bash echo "$ts|$input" >> "$DATA_DIR/ingest.log" ``` ### Technical Analysis The script creates its data directory and log files without setting a restrictive `umask` or explicitly assigning secure filesystem modes. Consequently, permissions depend on the process's ambient environment. With a common `umask` of `022`, the directory may be created as `0755` and log files as `0644`. This can allow other local accounts to traverse the directory and read the logs. The documented use cases include revenue figures, financial projections, queries, and other potentially confidential business-planning information. The issue affects `history.log` and all category-specific logs created through shell redirection. No authentication or file-permission validation is performed before data is appended. ### Attack Path 1. A user invokes the skill with confidential business information, such as revenue, customer, or financial-planning data. 2. The script creates `~/.local/share/bizplanner` and its log files under a permissive ambient `umask`. 3. The resulting directory and files are readable by another local account. 4. That account reads `~/.local/share/bizplanner/history.log` or another `*.log` file and obtains the recorded information. ### Impact Assessment This weakness can disclose all business data recorded by the utility to other users on the same host when filesystem permissions permit it. The exposure is limited to the affected user's Biz ...[truncated 321 chars]- Remediation
View remediation