T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/auth_checker.sh:50
- Finding
- Predictable Temporary File Allows Symlink-Based File Clobbering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auth_checker.sh`, lines 50-68 **Vulnerability Type**: Predictable temporary file and unsafe symbolic-link handling **Risk Level**: High ### Vulnerable Code ```bash if source "$HOME/.openclaw/.env" && openclaw status > /tmp/openclaw_status.txt 2>&1; then echo "✅ OpenClaw status command succeeded" # Check for auth-related errors in output (without showing sensitive info) if grep -iq "auth" /tmp/openclaw_status.txt; then echo "ℹ️ Auth information found in status" fi if grep -iq "error\|fail\|unavailable" /tmp/openclaw_status.txt; then echo "⚠️ Potential issues detected in status" echo " Run 'openclaw status' manually to see details" fi else echo "❌ OpenClaw status command failed" echo " This suggests auth or gateway issues" echo " Check gateway is running: openclaw gateway status" fi # Clean up temp file rm -f /tmp/openclaw_status.txt ``` ### Technical Analysis The script writes OpenClaw status output to the fixed, globally predictable path `/tmp/openclaw_status.txt`. Shell redirection opens this path with truncation and follows symbolic links. The script neither creates the file securely nor verifies its ownership, type, or permissions before writing. On a multi-user system, another local user can create that path in advance as a symbolic link to a file writable by the victim. When the victim runs the checker, the shell follows the link and truncates or overwrites the target using the victim's privileges. The fixed filename also permits concurrent executions to read, overwrite, or delete each other's output. Depending on the process umask, status output containing authentication-related or operational information may be readable by other local users before cleanup. ### Attack Path 1. A local attacker identifies a file that the victim can write and whose corruption would affect the victim. 2. The attacker creates ...[truncated 1233 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Create a unique temporary file securely and ensure it is deleted on every exit path: ```bash umask 077 STATUS_FILE=$(mktemp "${TMPDIR:-/tmp}/openclaw-status.XXXXXX") || { echo "Failed to create temporary file" >&2 exit 1 } trap 'rm -f -- "$STATUS_FILE"' EXIT if source "$HOME/.openclaw/.env" && openclaw status > "$STATUS_FILE" 2>&1; then if grep -iq "auth" "$STATUS_FILE"; then echo "Auth information found in status" fi if grep -Eiq "error|fail|unavailable" "$STATUS_FILE"; then echo "Potential issues detected in status" fi fi ``` Additional hardening measures: 1. Do not use a constant filename in a shared temporary directory. 2. Set `umask 077` before creating files that can contain operational or authentication-related information. 3. Use an `EXIT` trap so cleanup occurs after errors and signals. 4. Quote the generated filename and use `rm -f --` to prevent argument interpretation. 5. Avoid elevated execution; explicitly document that this diagnostic script should run as the OpenClaw account. 6. If persistent output is unnecessary, consider capturing output in a shell variable rather than writing it to disk. ]]>