T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/wsb-digest-trigger.sh:31
- Finding
- Predictable Shared Temporary Paths Permit File Overwrite and Data-Tampering Attacks## Vulnerability Details **File Location**: `scripts/wsb-digest-trigger.sh`, lines 31-34, 46-57, and 116 **Vulnerability Type**: Unsafe temporary-file and directory handling **Risk Level**: Medium ### Vulnerable Code ```bash LOG_FILE=/tmp/wsb-digest.log RAW_FILE=/tmp/wsb-raw.out JSON_FILE=/tmp/wsb-latest.json CHUNK_DIR=/tmp/wsb-digest-chunks ``` ```bash echo "[$(date '+%Y-%m-%d %H:%M:%S %Z')] Starting WSB Digest..." >> "$LOG_FILE" # 1) Fetch data if ! node "${SKILL_DIR}/scripts/apewisdom-wsb.js" > "$RAW_FILE" 2>> "$LOG_FILE"; then echo "[$(date '+%Y-%m-%d %H:%M:%S %Z')] ❌ Generator failed" >> "$LOG_FILE" exit 1 fi # 2) Extract JSON awk 'found{print} /^\{/{found=1; print}' "$RAW_FILE" > "$JSON_FILE" # 3) Split into chunks rm -rf "$CHUNK_DIR" mkdir -p "$CHUNK_DIR" ``` ```bash CHUNK_COUNT=$(cat "$CHUNK_DIR/count.txt") ``` ### Technical Analysis The trigger script uses fixed, predictable names in the globally writable `/tmp` directory for logs, raw API output, parsed JSON, and a recursively removed chunk directory. It does not create a private temporary directory with `mktemp`, apply a restrictive `umask`, validate ownership, reject symbolic links, or securely open the files. A local attacker can pre-create these paths as symbolic links or manipulate them between validation and use. Shell redirections such as `> "$RAW_FILE"`, `> "$JSON_FILE"`, and `>> "$LOG_FILE"` follow symbolic links. If the scheduled task runs with elevated privileges—as the root-specific paths and `HOME=/root` configuration anticipate—the writes occur with those elevated privileges. The fixed chunk directory also creates a race window around `rm -rf`, `mkdir`, Node.js file creation, and subsequent reads. An attacker who can replace or manipulate this directory may alter generated chunks or interfere with processing. ### Attack Path 1. The attacker obtains local access sufficient to create entries in `/tmp`. 2. Bef ...[truncated 1444 chars]
- Remediation
- ## Remediation Suggestions Create a unique private workspace for every invocation and store all intermediate files beneath it: ```bash umask 077 TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/wsb-digest.XXXXXX") trap 'rm -rf -- "$TMP_DIR"' EXIT RAW_FILE="$TMP_DIR/raw.out" JSON_FILE="$TMP_DIR/latest.json" CHUNK_DIR="$TMP_DIR/chunks" mkdir -- "$CHUNK_DIR" ``` Additional hardening should include: 1. Run the cron job under a dedicated, unprivileged service account rather than root. 2. Remove the forced `HOME=/root` assignment and root-specific executable and installation paths. 3. Store persistent logs in a dedicated directory owned by the service account, with permissions such as `0700` for the directory and `0600` for files. 4. If logs must remain under `/tmp`, create them securely inside the invocation-specific directory or use a system logging facility such as `logger`. 5. Avoid recursively deleting predictable paths in shared directories. 6. Validate ownership and file type before reading any persistent path that another user could modify. 7. Apply restrictive permissions before any API data or generated messages are written to disk.