T09 · Insecure Skill Coding Practices
Error
- Location
- references/requests.md:59
- Finding
- Predictable and Insecure Temporary Files Expose Authentication Tokens and Vehicle Data## Vulnerability Details **File Location**: `references/requests.md:59-60, 79-82, 99-100, 123, 132-134, 146, 154, 162` **Vulnerability Type**: Insecure temporary-file handling and plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```bash curl -sS -X "$method" "${KIA_BASE}/${path}" "${KIA_HDRS[@]}" \ ${body:+--data "$body"} -D /tmp/kia_hdrs --compressed ``` ```bash kia_curl POST prof/authUser "$(jq -nc \ --arg u "$KIA_USERNAME" --arg p "$KIA_PASSWORD" \ '{deviceKey:"",deviceType:2,userCredential:{userId:$u,password:$p},tncFlag:1}')" \ | tee /tmp/kia_auth.json | jq '.status, .payload.nextAction' OTPKEY=$(jq -r '.payload.otpKey' /tmp/kia_auth.json) XID=$(grep -i '^xid:' /tmp/kia_hdrs | tr -d '\r' | cut -d' ' -f2) ``` ```bash SID=$(grep -i '^sid:' /tmp/kia_hdrs | tr -d '\r' | cut -d' ' -f2) RMTOKEN=$(grep -i '^rmtoken:' /tmp/kia_hdrs | tr -d '\r' | cut -d' ' -f2) ``` ```bash SID=$(grep -i '^sid:' /tmp/kia_hdrs | tr -d '\r' | cut -d' ' -f2) ``` ```bash kia_curl GET ownr/gvl '' -- "sid: $SID" | tee /tmp/kia_gvl.json \ | jq '.payload.vehicleSummary[] | {nickName, modelYear, modelName, mileage, vehicleKey}' VIN=$(jq -r '.payload.vehicleSummary[0].vehicleKey' /tmp/kia_gvl.json) ``` ```bash kia_curl POST cmm/gvi "$GVI" -- "sid: $SID" "vinkey: $VIN" > /tmp/kia_gvi.json ``` ```bash jq '.payload.vehicleInfoList[0].lastVehicleInfo.vehicleStatusRpt.vehicleStatus | {doorLock, ign3, engine, climate: {airCtrl: .climate.airCtrl, temp: .climate.airTemp.value}, battery: .evStatus.batteryStatus, range: .evStatus.drvDistance[0].rangeByFuel.totalAvailableRange.value, synced: .syncDate.utc}' /tmp/kia_gvi.json ``` ```bash jq '.payload.vehicleInfoList[0].lastVehicleInfo.location | {lat: .coord.lat, lon: .coord.lon, synced: .syncDate.utc}' /tmp/kia_gvi.json ``` ### Technical Analysis The documented commands use fixed ...[truncated 2625 chars]
- Remediation
- ## Remediation Suggestions - Set a restrictive process mask before creating any sensitive files: ```bash umask 077 ``` - Create a unique private temporary directory instead of using fixed paths: ```bash KIA_TMPDIR=$(mktemp -d "${TMPDIR:-/tmp}/kiaaccess.XXXXXXXX") || exit 1 chmod 700 "$KIA_TMPDIR" trap 'rm -rf -- "$KIA_TMPDIR"' EXIT HUP INT TERM ``` - Replace every fixed temporary path with a file inside that directory, for example: ```bash KIA_HEADER_FILE="$KIA_TMPDIR/headers" KIA_AUTH_FILE="$KIA_TMPDIR/auth.json" KIA_GVL_FILE="$KIA_TMPDIR/gvl.json" KIA_GVI_FILE="$KIA_TMPDIR/gvi.json" ``` - Pass the private header path to the wrapper rather than hardcoding `/tmp/kia_hdrs`. - Avoid storing token-bearing response headers when possible. Capture required headers in memory or extract them immediately from a securely created file and delete that file as soon as parsing is complete. - Explicitly verify that sensitive files are regular files owned by the current user and are not symbolic links before reuse. - Retain the existing `chmod 600` protection for the durable session file and apply equivalent restrictive permissions to all temporary files containing credentials or location data. - Clear sensitive shell variables such as `SID`, `RMTOKEN`, and `OTPKEY` when the operation completes.