T09 · Insecure Skill Coding Practices
Error
- Location
lib/rpc.sh:4- Finding
Predictable shared temporary directory enables credential exposure and file clobbering
- Content
View full analysis
/dev/null || true NETRC_FILE="$dir/.netrc" local host; host=$(printf '%s' "${MONERO_RPC_URL:-}" | sed -E 's#^[a-z]+://##; s#[:/].*$##') : "${host:=127.0.0.1}" local user="${MONERO_RPC_USER:-}" pass="${MONERO_RPC_PASSWORD:-}" { printf 'machine %s\n' "$host" [[ -n "$user" ]] && printf 'login %s\n' "$user" [[ -n "$pass" ]] && printf 'password %s\n' "$pass" } > "$NETRC_FILE" chmod 600 "$NETRC_FILE" trap 'rm -f "$NETRC_FILE"' EXIT } ``` Related initialization: ```bash : "${MONERO_LOCK_DIR:=/tmp/agenta-monero}"; export MONERO_LOCK_DIR mkdir -p "$MONERO_LOCK_DIR"; chmod 700 "$MONERO_LOCK_DIR" 2>/dev/null || true ensure_netrc exec 200>"$MONERO_LOCK_DIR/agenta-monero.lock" ``` ### Technical Analysis The default runtime directory is the fixed, system-wide path `/tmp/agenta-monero`. The code uses `mkdir -p`, accepts an existing directory, and does not verify that the directory: - Is owned by the current user. - Is not a symbolic link. - Has the expected restrictive permissions. - Was created exclusively by the current process. - Does not contain attacker-created files or symbolic links. The initial `chmod 700` failure is explicitly ignored. The `.netrc` file is then opened using a normal shell redirection, which follows symbolic links and overwrites existing files. It contains the RPC username and password used to access a wallet RPC service capable of initiating wallet operations. Other files written under the same directory—including the lock, PID, port, log, and refresh timestamp files—are subject to the same unsafe trust boundary. ### Attack Path 1. A local attacker creates ...[truncated 1315 chars]- Remediation
View remediation