T09 · Insecure Skill Coding Practices
Warning
- Location
backups.md:18- Finding
Predictable Temporary Backup File Enables Symlink Attacks and Data Exposure
- Content
View full analysis
/tmp/backup_$TIMESTAMP.dump # Upload aws s3 cp /tmp/backup_$TIMESTAMP.dump $BUCKET/ # Cleanup local rm /tmp/backup_$TIMESTAMP.dump ``` ### Technical Analysis The documented backup script creates a database dump directly in the shared `/tmp` directory using a filename derived from the current timestamp. This name is predictable, and the script does not create the file atomically, verify that it is a regular file, restrict its permissions explicitly, or use a private temporary directory. Because shell redirection follows symbolic links, a local attacker who can write to `/tmp` may predict the filename and create a symbolic link at that location before the backup begins. When the shell processes the redirection, it may truncate and overwrite the symlink target with the privileges of the account running the backup job. The dump's permissions also depend on the process umask. With an overly permissive umask, other local users may be able to read the temporary database dump before it is uploaded and removed. The file can remain exposed indefinitely if `pg_dump`, the upload operation, or the script terminates unexpectedly, because no exit trap guarantees cleanup. ### Attack Path 1. The backup is configured to run at a known time, such as the documented daily 03:00 cron schedule. 2. A local low-privileged attacker predicts a filename such as `/tmp/backup_20260916_030000.dump`. 3. Before the backup starts, the attacker creates that path as a symbolic link to a file writable by the backup account. 4. The privileged shell opens the predictable path for output and follows the symbolic link. 5. The target file is truncated and receives PostgreSQL dump data, p ...[truncated 1074 chars]- Remediation
View remediation
"$BACKUP_FILE" aws s3 cp "$BACKUP_FILE" "$BUCKET/backup_$TIMESTAMP.dump" ``` The deployment should also verify that the dedicated account has only the database read privileges, bucket write permissions, and local filesystem access required for backups. ]]>