T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/atomic-write.sh:8- Finding
Predictable Temporary File Allows Symlink-Based File Overwrite
- Content
View full analysis
"$TMP" else shift printf '%s\n' "$*" > "$TMP" fi sync "$TMP" 2>/dev/null || sync mv "$TMP" "$FILE" ``` ### Technical Analysis The script derives its temporary path from the destination filename and process ID: ```bash TMP="${FILE}.tmp.$$" ``` Process IDs are observable or predictable on typical local systems. The temporary file is then opened using ordinary shell redirection without exclusive creation, a symbolic-link check, or a securely randomized filename. An attacker who can write to the destination directory can pre-create the predicted temporary path as a symbolic link. When `cat` or `printf` opens that path, the operating system follows the link and truncates the linked file using the invoking user's permissions. The final `mv` does not prevent the preceding redirected write. Even if the rename subsequently fails or replaces the symbolic link itself, the linked file may already have been overwritten. ### Attack Path 1. Identify a destination passed to `atomic-write.sh`, such as `memory/working-buffer.md`. 2. Observe or predict the process ID that will execute the script. 3. Create a symbolic link named `memory/working-buffer.md.tmp.` pointing to another file writable by the victim account. 4. Cause or wait for the victim to invoke `atomic-write.sh`. 5. The script follows the symbolic link when executing `cat > "$TMP"` or `printf ... > "$TMP"`. 6. The target of the symbolic link is truncated and replaced with the supplied memory content. Successful exploitation requires local write access to the destination directory and sufficient timing or process visibility to predict the temporary filename. ### Impact Assessment The vulnera ...[truncated 577 chars]- Remediation
View remediation
&2 exit 1 fi ``` 4. Write only to the file descriptor returned for the securely created temporary file. 5. Preserve intended ownership and mode where appropriate, then flush the file and parent directory before and after the atomic rename. 6. Rename using explicit option termination: ```bash mv -- "$TMP" "$FILE" trap - EXIT HUP INT TERM ``` 7. Add a regression test that pre-creates likely temporary filenames and symbolic links, confirming that no unrelated file can be modified. ]]>