T09 · Insecure Skill Coding Practices
- Location
SKILL.md:176- Finding
Predictable Shared Temporary Files Permit Symlink Attacks and Audit-Data Tampering
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 176–194
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Mediumbash # 1. 生成当前配置快照 az resource list --query '[].{Name:name, Type:type, RG:resourceGroup, Tags:tags}' > /tmp/azure-snapshot-current.json # 2. 与基线快照对比(假设基线快照已存在) if [ -f /tmp/azure-snapshot-baseline.json ]; then echo "=== 与基线对比 ===" diff <(jq -r '.[] | "\(.Type)/\(.Name)"' /tmp/azure-snapshot-baseline.json | sort) \ <(jq -r '.[] | "\(.Type)/\(.Name)"' /tmp/azure-snapshot-current.json | sort) || true fi # 3. 保存为新基线(用户确认后) # cp /tmp/azure-snapshot-current.json /tmp/azure-snapshot-baseline.jsonbash REPORT="/tmp/azure-inspection-$(date +%Y%m%d-%H%M%S).md"Technical Analysis
The Skill instructs the agent to store Azure inventory snapshots at fixed, globally predictable paths under
/tmp. It also creates reports with timestamp-based names, which are predictable and may be exposed under an insufficiently restrictive process umask.On a multi-user Unix-like system, another local user can pre-create
/tmp/azure-snapshot-current.jsonas a symbolic link. Standard shell output redirection follows symbolic links, so executing the documented command may truncate and overwrite a target file writable by the account running the Skill.The baseline path is also fixed and trusted based only on a file-existence check. An attacker able to write in the shared temporary directory can supply or replace the baseline with fabricated JSON, causing the drift comparison to produce false or misleading findings. No ownership, permission, regular-file, or symbolic-link validation is performed.
Attack Path
- An attacker with local access to the same host predicts the fixed snapshot or report path.
- For a file-overwrite attack, the attacker creates
/tmp/azure-snapshot-current.jsonas a symbolic link to a file writable by the victim account. - The victim invokes the Skill's configuration-drift workflo ...[truncated 1316 chars]
- Remediation
View remediation
Remediation Suggestions
- Create a private working directory rather than using fixed paths:
bash umask 077 WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/azure-inspection.XXXXXXXX")" || exit 1 trap 'rm -rf -- "$WORK_DIR"' EXIT CURRENT_SNAPSHOT="$WORK_DIR/azure-snapshot-current.json" REPORT="$WORK_DIR/azure-inspection.md"- Keep snapshots and reports inside that private directory, which should have mode
0700. - Use
mktempfor every generated file and avoid timestamp-only or otherwise predictable names. - Refuse symbolic links and validate that baseline files are regular files owned by the expected account before reading them.
- Store persistent baselines in a user-owned configuration or state directory rather than shared
/tmp, with directory mode0700and file mode0600. - Write output to a newly created temporary file and atomically rename it into place after successful generation.
- Apply
umask 077before creating files containing Azure inventory or subscription metadata. - Where supported, use APIs or file-opening mechanisms that enforce exclusive creation and do not follow symbolic links.
- Protect persistent baselines with integrity controls, such as a securely stored checksum or signature, if they are used as authoritative audit evidence.