T09 · Insecure Skill Coding Practices
Warning
- Location
- cleanup.sh:4
- Finding
- Predictable Temporary Log Path Allows Symlink-Based File Modification## Vulnerability Details **File Location**: `cleanup.sh`, lines 4-8 **Vulnerability Type**: Unsafe temporary file handling and symbolic-link following **Risk Level**: Medium ### Vulnerable Code ```bash LOG_FILE="/tmp/session-cleanup-$(date +%Y%m%d).log" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" } ``` ### Technical Analysis The script constructs a predictable daily log filename in the shared `/tmp` directory and opens it through `tee -a`. It does not securely create the file, verify its ownership, reject symbolic links, or use a private directory. If the script executes with elevated privileges and the operating system permits the privileged process to follow the link, another local user can create the expected path as a symbolic link to a file writable by the script's effective user. Each call to `log` then causes `tee` to follow that link and append script-controlled log text to the target. Exploitability can be reduced by operating-system symbolic-link protections, but the script itself does not enforce any protection and therefore must not rely on environment-specific hardening. ### Attack Path 1. A local attacker predicts the daily path, such as `/tmp/session-cleanup-20260911.log`. 2. Before the scheduled cleanup runs, the attacker creates that path as a symbolic link to a selected target file. 3. The cleanup script runs with an account, potentially `root`, that can write to the target. 4. `tee -a` opens the symbolic-link target and appends cleanup log entries. 5. The target file is modified or corrupted. The practical result depends on the target format and the content appended by the script. ### Impact Assessment This flaw can allow a local attacker to redirect privileged append operations to another file. If the cleanup job runs as `root`, the affected scope includes files writable by `root`, potentially causing configuration corruption or denial of service. The prim ...[truncated 237 chars]
- Remediation
- ## Remediation Suggestions - Store logs in a dedicated directory owned by the service account, with permissions such as `0700`, rather than directly under `/tmp`. - Create the log atomically with `mktemp` or an equivalent mechanism. - Set a restrictive file-creation mask, such as `umask 077`. - Reject existing symbolic links and verify the resulting file is a regular file owned by the expected account. - Prefer a managed logging facility such as the system journal when the task runs as a scheduled privileged service. - If a stable filename is required, securely create and open it without following symbolic links and apply restrictive permissions before writing.