T09 · Insecure Skill Coding Practices
Warning
- Location
crypto-monitor.sh:16- Finding
Predictable Shared Temporary Files Permit Symlink-Based File Overwrite and Cache Tampering
- Content
View full analysis
/dev/null || echo "0") if [ $((now - cache_time)) -lt 3600 ]; then cat "$cache_file" return fi fi local rate=7.25 local resp=$(curl -s --connect-timeout 3 "https://api.exchangerate-api.com/v4/latest/USD" 2>/dev/null || echo "") if [ -n "$resp" ]; then rate=$(echo "$resp" | python3 -c "import sys,json; print(json.load(sys.stdin)['rates'].get('CNY', 7.25))" 2>/dev/null || echo "7.25") fi mkdir -p /tmp/crypto-monitor echo "{\"rate\":$rate,\"timestamp\":$now}" > "$cache_file" cat "$cache_file" } ``` The same insecure pattern is used for these predictable paths: ```bash local cache_file="/tmp/crypto-monitor/prices.json" local cache_file="/tmp/crypto-monitor/metals.json" local history_file="/tmp/crypto-monitor/metals_history.json" ``` The metals data is subsequently written through those paths: ```bash mkdir -p /tmp/crypto-monitor echo "{\"gold\":$gold,\"silver\":$silver,\"gold_usd\":$gold_usd,\"silver_usd\":$silver_usd,\"timestamp\":$now}" > "$history_file" cat > "$cache_file" << EOF {"gold":$gold,"gold_cny":$gold_cny,"gold_usd":$gold_usd,"gold_change":$gold_change,"silver":$silver,"silver_cny":$silver_cny,"silver_usd":$silver_usd,"silver_change":$silver_change} EOF ``` ### Technical Analysis The script stores mutable state under the fixed, system-wide path `/tmp/crypto-monitor`. It does not: - Create the directory with restrictive permissions. - Verify that the directory belongs to the current user. - Verify that cache files are regular files rather th ...[truncated 2758 chars]- Remediation
View remediation
&2 return 1 fi ``` 5. Write updates atomically using a temporary file created inside the trusted directory: ```bash tmp_file=$(mktemp "$cache_root/exchange.json.XXXXXX") || exit 1 printf '%s\n' "$json" > "$tmp_file" chmod 600 "$tmp_file" mv -f -- "$tmp_file" "$cache_file" ``` 6. Avoid running the price-monitoring script with elevated privileges. Document that it is intended to run as an ordinary user. 7. Validate the type, ownership, permissions, schema, and numeric ranges of existing cache content before trusting it. ]]>