T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/reserve.py:348
- Finding
- Unverified PID File Allows Termination of Unrelated Processes<![CDATA[ ## Vulnerability Details **File Location**: `scripts/reserve.py:348-365` **Vulnerability Type**: Unverified process termination through a user-controlled PID file **Risk Level**: High ### Vulnerable Code ```python def run_stop(args): """Send SIGTERM to the background retry process.""" import signal pid_file = validate_safe_path(Path(args.pid_file)) if not pid_file.exists(): print(f"❌ PID 파일이 없습니다: {pid_file}") sys.exit(1) raw = pid_file.read_text().strip() if not raw.isdigit(): print(f"❌ PID 파일 내용이 유효하지 않습니다: {raw!r}") sys.exit(1) pid = int(raw) try: os.kill(pid, signal.SIGTERM) print(f"✅ 프로세스 {pid} 종료 요청 완료") except ProcessLookupError: print(f"⚠️ 프로세스 {pid}는 이미 종료되어 있습니다") except PermissionError: print(f"❌ 프로세스 {pid} 종료 권한 없음") sys.exit(1) ``` ### Technical Analysis The `reserve stop` command accepts an arbitrary PID-file path. Although `validate_safe_path()` restricts the path to the user's home directory or the system temporary directory, it does not establish that: - The file was created by this Skill. - The PID represents an SRT retry worker. - The process start time matches the worker that originally wrote the file. - The file is owned by the current user and has safe permissions. - The file is not a symlink or an attacker-controlled file in a shared temporary directory. After confirming only that the file contains digits, the code passes the value directly to `os.kill()` with `SIGTERM`. Consequently, the command can signal any process that the operating-system account is permitted to signal. This behavior exceeds the minimum privilege needed to stop an SRT retry worker. Path confinement is not process-identity validation. ### Attack Path 1. An attacker or untrusted caller identifies the PID of another process running under the same operating-system account. 2. The attacker creates a file under an accepted location, such as ...[truncated 1077 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store PID files only in a dedicated, application-controlled directory with mode `0700`, rather than accepting arbitrary files throughout the home and temporary directories. 2. Create PID files securely using exclusive creation and reject symbolic links. 3. Store additional worker identity information alongside the PID, including: - A cryptographically random launch token. - The process start time. - The expected executable and command-line arguments. 4. Before signaling, verify that the current process start time and command line match the recorded SRT retry worker. On Linux, this can be checked through `/proc/<pid>/stat` and `/proc/<pid>/cmdline`. 5. Verify that the PID file is a regular file owned by the current user and is not group- or world-writable. 6. Prefer retaining a process handle or using a dedicated authenticated local control channel when lifecycle management occurs within one supervising process. 7. Remove stale PID files after successful shutdown and refuse to act when any identity check fails. ]]>