T09 · Insecure Skill Coding Practices
Error
- Location
- templates/safe-try.sh:75
- Finding
- Predictable Temporary Directory Enables Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `templates/safe-try.sh:17-20, 75-81` **Vulnerability Type**: Unsafe predictable temporary file and directory usage **Risk Level**: High ### Vulnerable Code ```bash SANDBOX_DIR="/tmp/openclaw-sandbox-3.8" SANDBOX_CONFIG="$SANDBOX_DIR/.openclaw/openclaw.json" PROD_CONFIG="$HOME/.openclaw/openclaw.json" BACKUP_DIR="$HOME/.openclaw/backups" ``` ```bash create_sandbox_dir() { echo -e "${BLUE}[2/6] 创建沙盒目录（配置隔离 + 插件隔离）...${NC}" # 创建独立目录（不复制生产！） mkdir -p $SANDBOX_DIR/.openclaw/{extensions,agents/writer,agents/media,logs,backups} # 创建独立配置（空插件列表） cat > $SANDBOX_CONFIG << 'EOF' ``` ### Technical Analysis The script creates its sandbox under the fixed, publicly predictable path `/tmp/openclaw-sandbox-3.8`. It does not reject a pre-existing directory, verify path ownership, check for symbolic links, or create the directory atomically. The `cat > $SANDBOX_CONFIG` redirection follows symbolic links. A local attacker who can write to `/tmp` can therefore pre-create the expected directory hierarchy and make `openclaw.json` a symbolic link to another file writable by the victim. When the victim runs the script, the shell opens and truncates the symlink target before executing `cat`. The same predictable hierarchy is subsequently used for logs, backups, and the Gateway PID file, expanding the opportunity for local path-manipulation attacks. The unquoted path expansions are also unsafe coding practice, although the current hardcoded path contains no whitespace. ### Attack Path 1. A local attacker creates `/tmp/openclaw-sandbox-3.8/.openclaw`. 2. The attacker creates `openclaw.json` as a symbolic link to a file writable by the intended victim. 3. The victim invokes `templates/safe-try.sh`. 4. `mkdir -p` accepts the attacker-prepared hierarchy because it already exists. 5. The shell processes `cat > $SANDBOX_CONFIG` and follows the symbolic link. 6. The linked target is truncated and overwr ...[truncated 744 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a unique sandbox atomically with `mktemp -d`, for example: ```bash umask 077 SANDBOX_DIR="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-sandbox.XXXXXXXX")" ``` 2. Abort if secure temporary-directory creation fails. 3. Do not reuse a pre-existing fixed path. 4. Quote every path expansion: ```bash mkdir -p "$SANDBOX_DIR/.openclaw/extensions" cat > "$SANDBOX_CONFIG" <<'EOF' ``` 5. Ensure generated configuration and token-bearing files have mode `0600`. 6. Validate that critical files are regular files owned by the current user and are not symbolic links before writing. 7. Register cleanup handlers that stop the spawned Gateway and remove only the uniquely created directory: ```bash trap cleanup EXIT INT TERM ``` 8. Where supported, use no-follow or exclusive-creation semantics rather than ordinary shell redirection for security-sensitive files. ]]>