T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sleep.sh:9- Finding
Predictable Shared Temporary File Permits Journal Disclosure and Symlink Attacks
- Content
View full analysis
> "$JOURNAL_FILE" echo "╔══════════════════════════════════════════════════════════╗" echo "║ 📓 睡眠日记" echo "╚══════════════════════════════════════════════════════════╝" echo "" echo " ✅ 已记录 ${date} 的睡眠数据" echo "" echo "📋 最近7天记录:" echo "────────────────────────────────────────" printf " %-12s %-14s %-10s %-8s %s\n" "日期" "时间" "时长" "质量" "备注" echo " ─────────────────────────────────────────────────" if [ -f "$JOURNAL_FILE" ]; then tail -7 "$JOURNAL_FILE" | while IFS='|' read -r d t dur q n; do ``` ### Technical Analysis The script stores health-related journal records at the fixed, globally predictable path `/tmp/sleep_journal.txt`. It does not securely create the file, enforce restrictive permissions, verify ownership, or reject symbolic links before appending data. The shell append operator follows symbolic links. Consequently, an attacker who can prepare the path before the victim's first use may create a file or symbolic link at that location. Successful symbolic-link exploitation depends on operating-system protections such as Linux `fs.protected_symlinks`, but the underlying code remains unsafe and may be exploitable on systems without equivalent protections. The fixed path also causes all users and concurrent instances to target the same journal. Depending on the resulting file permissions, this can expose private sleep records or mix records belonging to different users. The script subsequently reads and displays the last seven lines from the same attacker-influenced file. ### Attack Path 1. The attacker predicts the hardcoded path `/tmp/sleep_journal.t ...[truncated 1419 chars]- Remediation
View remediation
&2 exit 1 fi if [ ! -e "$JOURNAL_FILE" ]; then (umask 077 && : > "$JOURNAL_FILE") fi if [ ! -f "$JOURNAL_FILE" ] || [ ! -O "$JOURNAL_FILE" ]; then printf 'Journal must be a regular file owned by the current user.\n' >&2 exit 1 fi chmod 600 -- "$JOURNAL_FILE" ``` 3. If temporary storage is genuinely required, create a private temporary directory with `mktemp -d`, install a cleanup trap, and place the journal inside that directory. Do not use a fixed name directly under `/tmp`. 4. Keep `umask 077` active while creating files containing health information so newly created files are accessible only to their owner. 5. For stronger resistance to race conditions, use a helper or implementation capable of opening the destination with exclusive creation and no-symbolic-link-following semantics, rather than performing a separate check followed by a shell redirection. ]]>