Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Predictable temp directory paths in pack management enable symlink attacks (CWE-377)

未关闭
  • 哪里不对？
#6,391 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
55/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
冷清
技术栈
python
领域
backend, security

调研方向

从 st2common/st2common/services/packs.py 开始，阅读 temp_backup_action_files、restore_temp_action_files 和 remove_temp_action_files，然后检查 st2common/st2common/util/pack_management.py 中的锁创建。将可预测的临时路径和基于 /tmp 的锁路径替换为安全的处理方式，同时保留 pack 备份、恢复、删除和安装锁定行为。完成的标准是：这些操作不再将可预测的 /tmp 路径暴露给 symlink 或锁文件攻击。

由索引模型根据 Issue 内容生成。

描述

Summary

Pack management functions use hardcoded, predictable paths under /tmp/ with os.mkdir instead of tempfile.mkdtemp. This creates a TOCTOU (time-of-check-time-of-use) race condition where a local attacker can pre-create a symlink at the expected path, causing StackStorm to write pack files to an arbitrary location.

Affected Files

st2common/st2common/services/packs.py

Three functions use predictable temp paths:

# Line 426
def temp_backup_action_files(pack_base_path, metadata_file, entry_point, temp_sub_dir):
    temp_dir_path = "/tmp/%s" % temp_sub_dir
    os.mkdir(temp_dir_path)

# Line 450
def restore_temp_action_files(pack_base_path, metadata_file, entry_point, temp_sub_dir):
    temp_dir_path = "/tmp/%s" % temp_sub_dir

# Line 468
def remove_temp_action_files(temp_sub_dir):
    temp_dir_path = "/tmp/%s" % temp_sub_dir
    if os.path.isdir(temp_dir_path):
        shutil.rmtree(temp_dir_path)
st2common/st2common/util/pack_management.py
# Line 120-123
temp_dir_name = hashlib.md5(
    pack_url.encode(), **hashlib_kwargs
).hexdigest()
lock_file = LockFile("/tmp/%s" % (temp_dir_name))

The lock file path is derived from an MD5 hash of the pack URL, which is predictable and not collision-resistant.

Impact

A local attacker with write access to /tmp/ can:

  1. Symlink attack on temp_backup_action_files: Pre-create a symlink at the expected path before os.mkdir is called. If the symlink points to a directory the attacker controls, pack files will be written there, potentially leaking sensitive configuration or entry point code.

  2. Symlink attack on restore_temp_action_files: Replace the temp directory with a symlink pointing to attacker-controlled content. When StackStorm restores from the "backup," it copies the attacker's files into the pack directory, achieving arbitrary code execution via a malicious entry point.

  3. Lock file manipulation: The predictable lock file path allows an attacker to pre-create the lock file, causing a denial of service (pack installations hang waiting for the lock), or to delete the lock file to cause concurrent pack installations to race.

Recommended Fix

Use tempfile.mkdtemp for all temporary directories:

import tempfile

# Instead of:
temp_dir_path = "/tmp/%s" % temp_sub_dir
os.mkdir(temp_dir_path)

# Use:
temp_dir_path = tempfile.mkdtemp(prefix="st2_pack_backup_")

For the lock file, use a directory under StackStorm's control (e.g., /opt/stackstorm/locks/) rather than /tmp/.

References

  • CWE-377: Insecure Temporary File
  • CWE-362: Race Condition (TOCTOU)
  • Discovered via manual code review
主要语言
Python
星标
6.5k
派生
792
平均合并
1 天 3 小时
30 天内合并 PR
4

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

StackStorm/st2 的其他 Issue

查看 StackStorm/st2 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。