T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_nav.py:19- Finding
Predictable Shared Cache File Allows Symlink-Based File Overwrite and Cache Poisoning
- Content
View full analysis
List[Dict[str, Any]]: """Load scheme list from cache, refreshing if stale or missing.""" if CACHE_PATH.exists() and (time.time() - CACHE_PATH.stat().st_mtime) < CACHE_MAX_AGE: with open(CACHE_PATH) as f: return json.load(f) return refresh_cache() def refresh_cache() -> List[Dict[str, Any]]: """Download full scheme list and write to cache.""" data = api_get("/mf") CACHE_PATH.write_text(json.dumps(data)) return data ``` ### Technical Analysis The script stores cached API data at the fixed path `/tmp/mfapi-schemes.json`. On multi-user systems, `/tmp` is normally writable by every local user. Although the directory commonly has the sticky bit enabled, that does not prevent an attacker from creating a previously nonexistent file or symbolic link at this predictable path. The script does not: - Verify that the cache is a regular file rather than a symbolic link. - Verify that the cache is owned by the current user. - Apply restrictive file permissions explicitly. - Create the cache through an exclusive, race-resistant operation. - Write to a securely created temporary file and atomically replace the cache. - Protect the check-and-use sequence from time-of-check/time-of-use races. `Path.write_text()` follows an existing symbolic link. Therefore, during a cache refresh, a malicious link can redirect the write to another file writable by the victim account. The cache-reading path also accepts any sufficiently recent JSON file at the shared location, allowing another local user to supply forged scheme records. ### Attack Path #### Symlink-based file overwrite 1. A local attacker predicts the fixed cache path ` ...[truncated 1923 chars]- Remediation
View remediation