T09 · Insecure Skill Coding Practices
Error
- Location
references/war-room-example.md:623- Finding
Predictable Temporary JavaScript File Enables Symlink and Race Attacks
- Content
View full analysis
"$TEMP_FILE" echo "💻 Executing spawn script..." node "$TEMP_FILE" # Cleanup rm "$TEMP_FILE" ``` ### Technical Analysis The deployment example creates executable JavaScript under `/tmp` using a predictable filename derived from the shell process ID. It neither creates the file atomically nor verifies that the destination is a regular file owned by the current user. Shared temporary directories are normally writable by all local users. An attacker who predicts or observes the process ID can pre-create the path as a symbolic link. The subsequent shell redirection follows that link and overwrites its target with the generated JavaScript. There is also a time-of-check/time-of-use window between writing the file and executing it with Node, allowing another local process to attempt substitution or modification. The temporary file is not created with explicit restrictive permissions. Cleanup is also not protected by a trap, so interruption can leave generated configuration and task instructions in `/tmp`. ### Attack Path 1. A local attacker monitors processes or predicts the victim shell's process ID. 2. The attacker creates `/tmp/spawn-war-room-PID.js` as a symbolic link to a file writable by the victim, or prepares to race replacement of the path. 3. The victim runs the documented deployment script. 4. `echo "$SPAWN_SCRIPT" > "$TEMP_FILE"` follows the attacker-controlled link and overwrites the target. 5. Alternatively, the attacker replaces or modifies the temporary JavaScript before `node "$TEMP_FILE"` executes. 6. If replacement succeeds, attacker-controlled JavaSc ...[truncated 599 chars]- Remediation
View remediation
"$TEMP_FILE" chmod 600 "$TEMP_FILE" node "$TEMP_FILE" ``` - Use exclusive file creation and reject symbolic links where supported. - Do not interpolate configuration directly into executable JavaScript. Parse configuration as JSON and validate its schema. - Ensure cleanup runs on normal exit, errors, and signals. ]]>