T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/speak.sh:23
- Finding
- Predictable Temporary Files Permit Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/speak.sh`, lines 23-24 and 45 **Vulnerability Type**: Predictable temporary files and unsafe file creation **Risk Level**: Medium ### Vulnerable Code ```bash TMP_WAV="/tmp/qwen_tts_$$.wav" TMP_OGG="/tmp/qwen_tts_$$.ogg" # Download audio curl -s -o "$TMP_WAV" "$AUDIO_URL" # Convert to an OGG format supported by Feishu ffmpeg -i "$TMP_WAV" -c:a libopus -b:a 64k -ar 48000 "$TMP_OGG" -y 2>/dev/null ``` ### Technical Analysis The script constructs temporary filenames directly under `/tmp` using only the current process ID. Process IDs are observable and sufficiently predictable on multi-user systems. The script does not atomically reserve these files before `curl` and `ffmpeg` write to them. An attacker with local access can pre-create a matching path as a symbolic link or race the script between path selection and file creation. Depending on ownership and operating-system protections, the write operation may follow the link and overwrite another file writable by the Skill's invoking account. At minimum, pre-created paths can interfere with processing and cause denial of service. Shell quoting prevents command injection through these variables, but it does not protect against filesystem race conditions or symbolic links. ### Attack Path 1. A local attacker monitors process creation or predicts the process ID that will execute `speak.sh`. 2. The attacker creates `/tmp/qwen_tts_<PID>.wav` or `/tmp/qwen_tts_<PID>.ogg` before the script writes to it. 3. The path is made a symbolic link to a target file, or an incompatible file is placed there to disrupt execution. 4. `curl` or `ffmpeg` accesses the attacker-controlled path. 5. If the target is writable by the invoking user and platform protections permit following the link, its contents may be overwritten. Otherwise, the operation fails, resulting in denial of service. ### Impact Assessment Successful exploitation can overwrite files accessible t ...[truncated 318 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Create a private temporary directory atomically and store all generated files within it: ```bash TMP_DIR="$(mktemp -d)" || exit 1 trap 'rm -rf -- "$TMP_DIR"' EXIT TMP_WAV="$TMP_DIR/audio.wav" TMP_OGG="$TMP_DIR/audio.ogg" ``` Additional hardening should include: 1. Set a restrictive file-creation mask with `umask 077`. 2. Do not construct temporary paths from process IDs or other predictable values. 3. Use `curl --fail --show-error` and verify successful downloads before invoking `ffmpeg`. 4. Check the exit status of `ffmpeg` before reporting the output path. 5. Keep cleanup in an `EXIT` trap so temporary files are removed on both success and failure. ]]>