T09 · Insecure Skill Coding Practices
Error
- Location
scripts/safe_apply.sh:42- Finding
Predictable Shared Temporary Status File Enables Symlink-Based File Overwrite
- Content
View full analysis
/dev/null 2>&1 || true sleep 2 } health_ok() { if ! bash -lc "$HEALTH_CMD" >"$STATUS_FILE" 2>&1; then return 1 fi grep -q "$HEALTH_GREP" "$STATUS_FILE" } ``` ### Technical Analysis The status filename is generated in the shared `/tmp` directory using a timestamp with one-second granularity. It is therefore predictable and is not created atomically. The shell subsequently opens the path through output redirection: ```bash >"$STATUS_FILE" ``` No checks establish that the path is a newly created regular file, that it is owned by the invoking user, or that it is not a symbolic link. An attacker with local access can predict or race the filename and create a symbolic link at that path before the health command runs. Where operating-system symbolic-link protections do not block the operation, shell redirection follows the link and truncates its target before writing the health-command output. The operation occurs with the privileges of the user running `safe_apply.sh`. The status file is also not deleted after execution, and the script does not use a private temporary directory or a cleanup trap. ### Attack Path 1. A local attacker determines when a privileged operator is likely to invoke the script. 2. The attacker calculates likely values of `date +%Y%m%d-%H%M%S`. 3. The attacker creates one or more matching paths such as: ```bash ln -s /target/file /tmp/openclaw-safe-status-20260911-120000.txt ``` 4. The operator runs `safe_apply.sh` during the predicted second. 5. `health_ok` redirects health-command output to the attac ...[truncated 962 chars]- Remediation
View remediation