T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/safe_apply.sh:27
- Finding
- Predictable Files in Shared Temporary Directory Permit Acknowledgment Bypass and Symlink Attacks## Vulnerability Details **File Location**: `scripts/safe_apply.sh`, lines 27-28, 38, and 49-54 **Vulnerability Type**: Predictable and insecure temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash ACK_FILE="/tmp/openclaw-config-ack-${TS}.ok" STATUS_FILE="/tmp/openclaw-safe-status-${TS}.txt" ``` ```bash if ! openclaw gateway status >"$STATUS_FILE" 2>&1 || ! grep -q "RPC probe: ok" "$STATUS_FILE"; then ``` ```bash if [[ "$REQUIRE_ACK" -eq 1 ]]; then echo "[safe-apply] ack required within ${ACK_TIMEOUT}s" echo "[safe-apply] ack file: $ACK_FILE" echo "touch '$ACK_FILE'" elapsed=0 while [[ $elapsed -lt $ACK_TIMEOUT ]]; do if [[ -f "$ACK_FILE" ]]; then echo "[safe-apply] ack received" rm -f "$ACK_FILE" exit 0 fi ``` ### Technical Analysis Both temporary paths are generated directly under the shared `/tmp` directory using a timestamp with one-second resolution. These names are predictable and are not created atomically. The script does not use a private temporary directory, verify file ownership, reject symbolic links, or bind acknowledgment to an unpredictable token. The acknowledgment check accepts any object for which `[[ -f "$ACK_FILE" ]]` succeeds. Consequently, another local user can predict or race the timestamp and create the file before the check. The script then treats that file as an authorized manual acknowledgment. The status-file redirection also follows symbolic links. A local attacker who predicts the filename can pre-create it as a symbolic link. When the script runs, shell redirection may truncate or overwrite the symlink target using the invoking user's privileges. The target must still be writable by that user, but execution under a privileged account would increase the affected scope. ### Attack Path 1. A local attacker observes or estimates when the script will be started. 2. The attacker calculates the timestamp-base ...[truncated 1233 chars]
- Remediation
- ## Remediation Suggestions - Create a private temporary directory atomically with `mktemp -d`, and ensure it is accessible only to the current user: ```bash TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-safe-apply.XXXXXXXX")" chmod 700 "$TMP_DIR" ACK_FILE="$TMP_DIR/ack" STATUS_FILE="$TMP_DIR/status" trap 'rm -rf -- "$TMP_DIR"' EXIT ``` - Use an unpredictable acknowledgment token or an authenticated communication channel rather than treating the existence of a predictable file as authorization. - If file acknowledgment remains necessary, verify that it is a regular file owned by the expected user and not a symbolic link. - Open output files using a mechanism that rejects existing files and symbolic links, or keep all files inside the private directory. - Remove temporary artifacts reliably through an `EXIT` trap, including after errors and received signals.