T09 · Insecure Skill Coding Practices
Error
- Location
scripts/handle-stop.sh:176- Finding
TOCTOU Symlink Race in Stop-Flag Creation
- Content
View full analysis
"${FLAG_FILE}" << EOF { "sessionId": "${SESSION_ID}", "timestamp": $(date +%s%3N), "reason": "${REASON_ESCAPED}", "signal": "SIGINT", "createdBy": "${CURRENT_USER}", "version": "1.0.2" } EOF chmod 0600 "${FLAG_FILE}" ``` ### Technical Analysis The stop flag uses a predictable path under the shared `/tmp` directory. Although the script rejects a symbolic link before writing, the symbolic-link check and the subsequent file creation are separate filesystem operations. A local attacker can replace the checked path with a symbolic link after the `-L` test succeeds but before the shell processes the output redirection. This is a classic time-of-check/time-of-use race. Shell redirection follows symbolic links, so the destination file would be opened and truncated using the privileges of the account running the skill. The subsequent `chmod 0600` can also follow the substituted path and modify the target file's permissions. ### Attack Path 1. The attacker predicts or learns the session ID. 2. The attacker monitors `/tmp/agent-stop-.flag`. 3. The interruption script checks that the path is not a symbolic link. 4. Before the `cat > "${FLAG_FILE}"` redirection occurs, the attacker creates or replaces that path with a symbolic link to a victim file. 5. The script follows the symbolic link and truncates or overwrites the victim file. 6. The script may set the victim file's permissions to `0600`. Successful exploitation requires local filesystem access and the ability to win the race. The target must be writable by the accou ...[truncated 528 chars]- Remediation
View remediation