T09 · Insecure Skill Coding Practices
- Location
install.sh:201- Finding
Predictable Temporary Plan File Allows Symlink-Based File Clobbering
- Content
View full analysis
Vulnerability Details
File Location:
install.sh, lines 201-208
Vulnerability Type: Predictable temporary file and unsafe shell redirection
Risk Level: MediumVulnerable Code
bash PLAN_FILE="/tmp/carpe-diem-install-$$.json" PLAN_ARGS=("--platform" "$PLATFORM" "--json") if [ -n "$TARGET" ]; then PLAN_ARGS+=("--target" "$TARGET") fi "$PYTHON" scripts/carpe_diem.py install plan "${PLAN_ARGS[@]}" > "$PLAN_FILE" 2>/dev/nullTechnical Analysis
The installer creates its plan at a predictable path derived from the process ID. It then opens that path using ordinary shell output redirection without secure exclusive creation or a private temporary directory.
On systems where other local users can write to
/tmp, an attacker can predict or race the installer process ID and create the expected path as a symbolic link. Shell redirection follows symbolic links, so the installer may truncate and overwrite an attacker-selected file that is writable by the victim running the installer.The plan file is also left in
/tmpafter a normal installation. Its permissions depend on the invoking user'sumask, and it contains local source and target paths. Under permissive settings, this may disclose filesystem layout information to other local users.Attack Path
- A local attacker monitors or estimates process IDs assigned to processes run by the victim.
- The attacker creates a symbolic link such as
/tmp/carpe-diem-install-<predicted-pid>.jsonpointing to a file writable by the victim. - The victim launches
install.shwith the predicted process ID. - The shell evaluates the output redirection and follows the attacker-created symbolic link.
- The linked file is truncated and replaced with the generated installation-plan JSON.
- If the attacker wins the race, this can corrupt user configuration or other files available under the victim's existing permissions.
Impact Ass
...[truncated 554 chars]
- Remediation
View remediation
Remediation Suggestions
Replace the predictable path with a securely created temporary file, restrict its permissions, and guarantee cleanup:
bash PLAN_FILE="$(mktemp "${TMPDIR:-/tmp}/carpe-diem-install.XXXXXX.json")" chmod 600 "$PLAN_FILE" trap 'rm -f -- "$PLAN_FILE"' EXIT PLAN_ARGS=("--platform" "$PLATFORM" "--json") if [ -n "$TARGET" ]; then PLAN_ARGS+=("--target" "$TARGET") fi "$PYTHON" scripts/carpe_diem.py install plan "${PLAN_ARGS[@]}" > "$PLAN_FILE" 2>/dev/nullAdditional hardening measures:
- Prefer a private directory created with
mktemp -dif more temporary artifacts are added. - Ensure the temporary file is created atomically rather than checking for existence before creation.
- Use a cleanup trap covering successful execution, failures, and signals.
- Do not intentionally retain the plan after dry runs unless the user explicitly requests an output path.
- If retaining a plan is necessary, place it in a user-controlled directory with mode
0600and clearly report its location.
- Prefer a private directory created with