T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geo-daily-monitor.sh:14- Finding
Predictable Temporary File Allows Symlink-Based File Truncation
- Content
View full analysis
/tmp/geo-test-output.txt 2>&1 ``` ### Technical Analysis The monitoring wrapper redirects command output to the fixed, predictable path `/tmp/geo-test-output.txt`. Shared temporary directories are normally writable by other local users, and shell redirection follows symbolic links. A local attacker who can create files in `/tmp` could create `/tmp/geo-test-output.txt` as a symbolic link to another file writable by the account running this script. When the scheduled monitoring job starts, the shell opens the symlink target with truncation enabled before executing Python. The risk is elevated when the script is run through cron or another scheduler under an account with access to files the attacker cannot modify directly. The temporary file does not require a stable name for the Skill's declared functionality, so using a shared predictable path exceeds minimum-safe file privileges. ### Attack Path 1. The attacker identifies that the daily monitoring wrapper runs periodically. 2. The attacker creates a symbolic link at the predictable path: ```bash ln -s /path/to/target /tmp/geo-test-output.txt ``` 3. The scheduled job runs `geo-daily-monitor.sh`. 4. Shell redirection follows the symbolic link and opens the target file with truncation enabled. 5. The target is erased or replaced with GEO monitoring output. Exploitation requires local access and a target file writable by the account executing the monitoring job. ### Impact Assessment Successful exploitation can truncate or corrupt any file writable by the scheduled job's account. Possible consequences include loss of application data, corrupted configuration, denial of service, or modification of operational files. This issue does not independently grant privile ...[truncated 200 chars]- Remediation
View remediation
"$OUTPUT_FILE" 2>&1 SUMMARY=$(tail -50 "$OUTPUT_FILE" | grep -A 20 "SUMMARY REPORT" || echo "Test completed") ``` Additional hardening measures: - Run the scheduled job under a dedicated, unprivileged service account. - Do not use a fixed filename in a globally writable directory. - Apply a restrictive `umask`, such as `umask 077`, near the start of the script. - If persistent logs are required, store them in an application-owned directory with restrictive permissions instead of `/tmp`. ]]>