T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/alert-sender.sh:12- Finding
Predictable and Symlink-Unsafe Cooldown State Files
- Content
View full analysis
"$cooldown_file" return 0 } ``` ### Technical Analysis The script stores alert cooldown state in the fixed, predictable directory `/tmp/monitor-cooldown`. It does not: - Create an owner-only runtime directory. - Set a restrictive `umask`. - Verify directory or file ownership. - Reject symbolic links. - Create files exclusively or update them atomically. - Ensure that the derived state filename belongs to the current monitoring process. The redirection `date +%s > "$cooldown_file"` follows symbolic links. An attacker with local access can prepare the directory, replace it with a link to another directory before first use, or plant predictable rule-derived files and symbolic links. The filename normalization is also weak: only spaces and forward slashes are replaced, so names such as `..` or names containing other problematic characters are not robustly constrained. Reading attacker-controlled cooldown content can also cause arithmetic errors or manipulate alert timing. A future numeric timestamp suppresses the corresponding alert because the calculated elapsed time becomes negative and remains less than the cooldown value. ### Attack Path 1. The attacker learns or predicts a monitoring rule name. 2. Before the monito ...[truncated 1413 chars]- Remediation
View remediation