T09 · Insecure Skill Coding Practices
- Location
scripts/wsb-digest-trigger.sh:31- Finding
Predictable Shared Temporary Paths Permit File Overwrite and Data-Tampering Attacks
- Content
View full analysis
Vulnerability Details
File Location:
scripts/wsb-digest-trigger.sh, lines 31-34, 46-57, and 116
Vulnerability Type: Unsafe temporary-file and directory handling
Risk Level: MediumVulnerable Code
bash LOG_FILE=/tmp/wsb-digest.log RAW_FILE=/tmp/wsb-raw.out JSON_FILE=/tmp/wsb-latest.json CHUNK_DIR=/tmp/wsb-digest-chunksbash echo "[$(date '+%Y-%m-%d %H:%M:%S %Z')] Starting WSB Digest..." >> "$LOG_FILE" # 1) Fetch data if ! node "${SKILL_DIR}/scripts/apewisdom-wsb.js" > "$RAW_FILE" 2>> "$LOG_FILE"; then echo "[$(date '+%Y-%m-%d %H:%M:%S %Z')] ❌ Generator failed" >> "$LOG_FILE" exit 1 fi # 2) Extract JSON awk 'found{print} /^\{/{found=1; print}' "$RAW_FILE" > "$JSON_FILE" # 3) Split into chunks rm -rf "$CHUNK_DIR" mkdir -p "$CHUNK_DIR"bash CHUNK_COUNT=$(cat "$CHUNK_DIR/count.txt")Technical Analysis
The trigger script uses fixed, predictable names in the globally writable
/tmpdirectory for logs, raw API output, parsed JSON, and a recursively removed chunk directory. It does not create a private temporary directory withmktemp, apply a restrictiveumask, validate ownership, reject symbolic links, or securely open the files.A local attacker can pre-create these paths as symbolic links or manipulate them between validation and use. Shell redirections such as
> "$RAW_FILE",> "$JSON_FILE", and>> "$LOG_FILE"follow symbolic links. If the scheduled task runs with elevated privileges—as the root-specific paths andHOME=/rootconfiguration anticipate—the writes occur with those elevated privileges.The fixed chunk directory also creates a race window around
rm -rf,mkdir, Node.js file creation, and subsequent reads. An attacker who can replace or manipulate this directory may alter generated chunks or interfere with processing.Attack Path
- The attacker obtains local access sufficient to create entries in
/tmp. - Bef ...[truncated 1444 chars]
- The attacker obtains local access sufficient to create entries in
- Remediation
View remediation
Remediation Suggestions
Create a unique private workspace for every invocation and store all intermediate files beneath it:
bash umask 077 TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/wsb-digest.XXXXXX") trap 'rm -rf -- "$TMP_DIR"' EXIT RAW_FILE="$TMP_DIR/raw.out" JSON_FILE="$TMP_DIR/latest.json" CHUNK_DIR="$TMP_DIR/chunks" mkdir -- "$CHUNK_DIR"Additional hardening should include:
- Run the cron job under a dedicated, unprivileged service account rather than root.
- Remove the forced
HOME=/rootassignment and root-specific executable and installation paths. - Store persistent logs in a dedicated directory owned by the service account, with permissions such as
0700for the directory and0600for files. - If logs must remain under
/tmp, create them securely inside the invocation-specific directory or use a system logging facility such aslogger. - Avoid recursively deleting predictable paths in shared directories.
- Validate ownership and file type before reading any persistent path that another user could modify.
- Apply restrictive permissions before any API data or generated messages are written to disk.