T09 · Insecure Skill Coding Practices
Warning
- Location
- schedule.sh:16
- Finding
- Predictable Temporary File Allows Symlink-Based File Overwrite## Vulnerability Details **File Location**: `schedule.sh`, line 16 **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code ```bash # 方式1：如果通过 cron 的 agentTurn 发送系统事件 echo "$CONTENT" > /tmp/crypto-learning-today.txt ``` ### Technical Analysis The scheduled script writes learning content to the fixed path `/tmp/crypto-learning-today.txt`. `/tmp` is ordinarily shared and writable by all local users. Shell output redirection follows symbolic links and does not verify that the destination is a regular file owned by the expected account. A local attacker can therefore create `/tmp/crypto-learning-today.txt` as a symbolic link to another file before the scheduled script runs. If the target file is writable by the account executing the script, the redirection will truncate that target and replace its contents with the generated lesson. Quoting `"$CONTENT"` prevents shell word splitting but does not mitigate destination-path or symbolic-link attacks. ### Attack Path 1. The attacker obtains local access to the host and predicts the hardcoded temporary filename. 2. Before the scheduled execution, the attacker creates a symbolic link at `/tmp/crypto-learning-today.txt` pointing to a target file. 3. The scheduler invokes `schedule.sh`. 4. `crypto_learning.py next` generates the lesson and advances the local progress state. 5. The shell processes the redirection on line 16, follows the attacker-created symbolic link, and truncates the linked target. 6. The lesson text is written into the target file under the scheduler account's privileges. Exploitation is limited to target files writable by the account executing the scheduled job. The finding does not establish that the script runs as root. ### Impact Assessment Successful exploitation permits arbitrary file overwrite within the scheduled-task account's existing write permissions. Possible consequences include: - Corruption ...[truncated 489 chars]
- Remediation
- ## Remediation Suggestions Remove the temporary-file write if no consumer requires it. If a file is necessary, create a unique file securely, restrict its permissions, and ensure cleanup: ```bash TMP_FILE="$(mktemp "${TMPDIR:-/tmp}/crypto-learning.XXXXXX")" || exit 1 chmod 600 "$TMP_FILE" trap 'rm -f "$TMP_FILE"' EXIT printf '%s\n' "$CONTENT" > "$TMP_FILE" ``` Additional hardening measures: 1. Run the scheduled task under a dedicated, unprivileged service account. 2. If a stable handoff location is required, use a private directory owned by that account with mode `0700`, rather than a shared `/tmp` path. 3. Do not check a path and then open it in separate operations, because that introduces a time-of-check/time-of-use race. 4. Use `printf` instead of `echo` for predictable handling of content beginning with options or containing escape sequences. 5. Configure a restrictive `umask`, such as `umask 077`, before creating output files.