T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/inspect.sh:14
- Finding
- Predictable Temporary Report Path Permits Symlink-Based Privileged File Corruption<![CDATA[ ## Vulnerability Details **File Location**: `scripts/inspect.sh:14-16` **Vulnerability Type**: Predictable and unsafe temporary-file creation **Risk Level**: High ### Vulnerable Code ```bash # Output file REPORT_FILE="/tmp/ubuntu_inspection_$(date +%Y%m%d_%H%M%S).txt" echo "========================================" | tee -a "$REPORT_FILE" ``` The same report path is subsequently opened numerous times through `tee -a "$REPORT_FILE"`. ### Technical Analysis The script constructs its report filename from a timestamp with one-second precision and writes it directly into the shared `/tmp` directory. It does not use an atomic temporary-file creation mechanism such as `mktemp`, does not reject symbolic links, and does not verify the file's type or ownership before opening it. The documentation states that root privileges may be required for complete information. If the script is run as root, each `tee -a` invocation follows symbolic links and opens the link target with the script's elevated privileges. An unprivileged local attacker can predict or repeatedly generate candidate report names and place symbolic links at those paths. If a candidate matches the execution timestamp, the script appends its output to an attacker-selected file. The appended text is not fully attacker-controlled, so this is primarily a privileged file-corruption primitive rather than arbitrary file replacement. Nevertheless, corrupting security-sensitive configuration or structured system files can cause denial of service and may create escalation opportunities when combined with a suitable target and parser behavior. The use of append mode does not mitigate the issue because symbolic links are still followed when the target is opened. ### Attack Path 1. The attacker obtains local access to the host and monitors or predicts when an administrator will run the inspector. 2. The attacker calculates likely filenames such as `/tmp/ubuntu_inspection_20260912_143000.txt`. 3. Befo ...[truncated 1087 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Set a restrictive process umask before creating any report: ```bash umask 077 ``` - Atomically create the report with `mktemp` rather than deriving its name directly from the current time: ```bash REPORT_FILE="$(mktemp /tmp/ubuntu_inspection.XXXXXXXXXX)" ``` - Prefer a private temporary directory: ```bash REPORT_DIR="$(mktemp -d)" chmod 700 "$REPORT_DIR" REPORT_FILE="$REPORT_DIR/report.txt" ``` - Open a single trusted file descriptor once and direct all report output through it instead of repeatedly reopening the pathname. - Reject pre-existing files, symbolic links, and files not owned by the current user if a fixed location must be retained. - Avoid running the complete script as root. Isolate the small number of checks that require elevated access and grant only the minimum necessary permissions. - Add cleanup handling with `trap` if reports are intended to be temporary. ]]>