T09 · Insecure Skill Coding Practices
Error
- Location
install.sh:29- Finding
Predictable Temporary File Allows Privileged File Overwrite
- Content
View full analysis
/tmp/ask-search-wrapper install -m 755 /tmp/ask-search-wrapper "$INSTALL_BIN/ask-search" rm -f /tmp/ask-search-wrapper echo "✓ ask-search installed to $INSTALL_BIN/ask-search" ``` ### Technical Analysis The installer writes wrapper content to the fixed, globally predictable path `/tmp/ask-search-wrapper`. It neither securely creates the file nor verifies that the path is a regular file owned by the current process. On systems that do not enforce effective protected-symlink or protected-regular-file restrictions, another local user can create this path before installation as a symbolic link to another file. The shell redirection performed by: ```bash echo "$WRAPPER" > /tmp/ask-search-wrapper ``` can then follow the symbolic link and overwrite its target using the installer's privileges. The risk is especially significant because installation into the default `/usr/local/bin` commonly causes users to invoke the script with `sudo`. Some modern Linux configurations mitigate portions of this attack through `fs.protected_symlinks` and `fs.protected_regular`, but the script must not rely on optional operating-system hardening. ### Attack Path 1. A local attacker predicts that a privileged user will run `install.sh`. 2. The attacker creates `/tmp/ask-search-wrapper` as a symbolic link to a file targeted for overwrite. 3. The administrator runs the installer with elevated privileges. 4. Shell redirection follows the attacker-controlled path and writes the generated wrapper into the target file. 5. Depending on the selected target, the attacker may corrupt system configuration o ...[truncated 472 chars]- Remediation
View remediation
"$TMP_WRAPPER" chmod 755 "$TMP_WRAPPER" install -m 755 -- "$TMP_WRAPPER" "$INSTALL_BIN/ask-search" ``` Additional hardening should include: - Set a restrictive `umask`, such as `umask 077`, before creating temporary files. - Quote every path and use `--` before path operands. - Validate that `INSTALL_BIN` is an expected directory. - Do not run the entire installer as root when only the final installation step requires elevated privileges. - Prefer packaging mechanisms that install immutable project files directly rather than constructing executables under `/tmp`. ]]>