T09 · Insecure Skill Coding Practices
Note
- Location
scripts/script.sh:5- Finding
Log and export files may be created with insecure permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` Example of the repeated entry-writing logic: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log") echo " [Stopwatch] run: $input" echo " Saved. Total run entries: $total" _log "run" "$input" ``` ### Technical Analysis The script stores user-provided text in persistent files under `~/.local/share/stopwatch`, but it neither establishes a restrictive `umask` nor explicitly sets permissions on the directory and files. Consequently, permissions are inherited from the execution environment. With a permissive `umask`, the data directory can be searchable by other local accounts and newly created logs or exports can be readable by them. Entries may contain task descriptions, operational notes, report content, configuration-related text, or other information that users reasonably expect to remain private. The issue affects command-specific logs, `history.log`, and export files created by the script. Exploitation is conditional on the host having multiple users and the script being executed with insufficiently restrictive default permissions. ### Attack Path 1. A user invokes a logging command and supplies sensitive or operationally useful text. 2. The script creates the data directory and log files without enforcing private permissions. 3. A permissive process `umask`, such as one that results in mode `0644` for files and `0755` for directories, leaves the records readable by other local users. 4. Another local account traverses `~/.local/share/stopwatch` and reads ...[truncated 475 chars]- Remediation
View remediation