T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/canary-test.sh:141- Finding
Privileged Arbitrary File Overwrite Through Predictable Temporary Storage
- Content
View full analysis
/dev/null)" ]; then for f in "$BACKUP_DIR"/*; do ORIGINAL=$(cat "$f.path" 2>/dev/null || echo "") if [ -n "$ORIGINAL" ] && [ -f "$f" ]; then sudo cp "$f" "$ORIGINAL" echo " ✅ Restored: $ORIGINAL" fi done ``` The corresponding backup creation logic is: ```bash CANARY_DIR="${CANARY_DIR:-/tmp/canary-deploy}" BACKUP_DIR="$CANARY_DIR/backups" mkdir -p "$CANARY_DIR" "$BACKUP_DIR" for f in "${BACKUP_FILES[@]}"; do if [ -f "$f" ]; then SAFE_NAME=$(echo "$f" | tr '/' '_') cp "$f" "$BACKUP_DIR/$SAFE_NAME" echo "$f" > "$BACKUP_DIR/$SAFE_NAME.path" echo " ✅ Backed up: $f" else echo " ⚠️ File not found: $f" fi done ``` ### Technical Analysis The scripts use the fixed, globally predictable path `/tmp/canary-deploy` for backup data and destination metadata. They create this path with `mkdir -p` but do not verify: - Whether the directory existed before execution. - Whether it is owned by the current trusted user. - Whether its permissions prevent modification by other local users. - Whether any component is a symbolic link. - Whether backup files and `.path` metadata are regular, trusted files. - Whether a rollback destination belongs to the set of files backed up during the current operation. Rollback treats the contents of `"$f.path"` as an authoritative destination and passes that value to `sudo cp`. This creates ...[truncated 2289 chars]- Remediation
View remediation