T09 · Insecure Skill Coding Practices
- Location
schedule.sh:16- Finding
Predictable Temporary File Allows Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
schedule.sh, line 16
Vulnerability Type: Unsafe predictable temporary file
Risk Level: MediumVulnerable Code
bash # 方式1：如果通过 cron 的 agentTurn 发送系统事件 echo "$CONTENT" > /tmp/crypto-learning-today.txtTechnical Analysis
The scheduled script writes learning content to the fixed path
/tmp/crypto-learning-today.txt./tmpis ordinarily shared and writable by all local users. Shell output redirection follows symbolic links and does not verify that the destination is a regular file owned by the expected account.A local attacker can therefore create
/tmp/crypto-learning-today.txtas a symbolic link to another file before the scheduled script runs. If the target file is writable by the account executing the script, the redirection will truncate that target and replace its contents with the generated lesson.Quoting
"$CONTENT"prevents shell word splitting but does not mitigate destination-path or symbolic-link attacks.Attack Path
- The attacker obtains local access to the host and predicts the hardcoded temporary filename.
- Before the scheduled execution, the attacker creates a symbolic link at
/tmp/crypto-learning-today.txtpointing to a target file. - The scheduler invokes
schedule.sh. crypto_learning.py nextgenerates the lesson and advances the local progress state.- The shell processes the redirection on line 16, follows the attacker-created symbolic link, and truncates the linked target.
- The lesson text is written into the target file under the scheduler account's privileges.
Exploitation is limited to target files writable by the account executing the scheduled job. The finding does not establish that the script runs as root.
Impact Assessment
Successful exploitation permits arbitrary file overwrite within the scheduled-task account's existing write permissions. Possible consequences include:
- Corruption ...[truncated 489 chars]
- Remediation
View remediation
Remediation Suggestions
Remove the temporary-file write if no consumer requires it. If a file is necessary, create a unique file securely, restrict its permissions, and ensure cleanup:
bash TMP_FILE="$(mktemp "${TMPDIR:-/tmp}/crypto-learning.XXXXXX")" || exit 1 chmod 600 "$TMP_FILE" trap 'rm -f "$TMP_FILE"' EXIT printf '%s\n' "$CONTENT" > "$TMP_FILE"Additional hardening measures:
- Run the scheduled task under a dedicated, unprivileged service account.
- If a stable handoff location is required, use a private directory owned by that account with mode
0700, rather than a shared/tmppath. - Do not check a path and then open it in separate operations, because that introduces a time-of-check/time-of-use race.
- Use
printfinstead ofechofor predictable handling of content beginning with options or containing escape sequences. - Configure a restrictive
umask, such asumask 077, before creating output files.