T09 · Insecure Skill Coding Practices
Error
- Location
- start.sh:6
- Finding
- Predictable Temporary Files Permit Token Disclosure, Symlink Attacks, and PID Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `start.sh:6-8`, `start.sh:11-30`, `start.sh:68-69`, `relay.py:359-363` **Vulnerability Type**: Unsafe predictable temporary files and plaintext secret logging **Risk Level**: High ### Vulnerable Code ```bash RELAY_PID_FILE="/tmp/browser-relay.pid" TOKEN_FILE="/tmp/browser-relay-token" LOG_FILE="/tmp/relay.log" # Stop an existing process using the PID file stop_relay() { if [ -f "$RELAY_PID_FILE" ]; then local pid=$(cat "$RELAY_PID_FILE") if kill -0 "$pid" 2>/dev/null; then kill "$pid" 2>/dev/null for i in $(seq 1 10); do kill -0 "$pid" 2>/dev/null || break sleep 0.5 done if kill -0 "$pid" 2>/dev/null; then kill -9 "$pid" 2>/dev/null fi echo "已停止旧进程 (PID: $pid)" fi rm -f "$RELAY_PID_FILE" fi } ``` ```bash nohup python3 -u relay.py > "$LOG_FILE" 2>&1 & RELAY_PID=$! echo "$RELAY_PID" > "$RELAY_PID_FILE" ``` ```python print(f" Auth token: {AUTH_TOKEN}") token_path = Path("/tmp/browser-relay-token") token_path.touch(mode=0o600, exist_ok=True) token_path.write_text(AUTH_TOKEN) os.chmod(token_path, stat.S_IRUSR | stat.S_IWUSR) ``` ### Technical Analysis The relay uses fixed, globally predictable paths under `/tmp` for its token, PID, and log files. Neither the shell script nor the Python implementation verifies that these paths are regular files owned by the current user and not symbolic links. The token file is opened through `Path.touch()` and `Path.write_text()`, both of which follow symbolic links. Applying `chmod()` afterward does not prevent the attack because the target may already have been overwritten. The operation can also unexpectedly change the permissions of the symlink target. The token is printed to standard output, while `start.sh` redirects standard output to `/tmp/relay.log`. The log is not explicitly created with restrictive perm ...[truncated 2262 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store runtime files in a private per-user directory such as `$XDG_RUNTIME_DIR/browser-relay`, created with mode `0700`. 2. Set `umask 077` before creating any token, PID, or log file. 3. Create security-sensitive files atomically with `O_CREAT | O_EXCL | O_NOFOLLOW` and mode `0600`. 4. Use `lstat()` or equivalent checks to reject symbolic links and verify that existing files are regular files owned by the current user. 5. Never print the bearer token to standard output or logs. Return only the token-file location. 6. Open the log explicitly with mode `0600`, or use a logging facility that enforces per-user access. 7. Validate PID-file content as a positive integer and verify `/proc/<pid>/cmdline`, executable identity, process owner, and preferably process start time before sending a signal. 8. Use a supervisor or process handle instead of trusting a reusable numeric PID where possible. 9. Remove token and PID files during orderly shutdown and rotate the token after any suspected disclosure. ]]>