Predictable temp directory paths in pack management enable symlink attacks (CWE-377)

[jaredbischof]

Summary

Pack management functions use hardcoded, predictable paths under /tmp/ with os.mkdir instead of tempfile.mkdtemp. This creates a TOCTOU (time-of-check-time-of-use) race condition where a local attacker can pre-create a symlink at the expected path, causing StackStorm to write pack files to an arbitrary location.

Affected Files

st2common/st2common/services/packs.py

Three functions use predictable temp paths:

# Line 426
def temp_backup_action_files(pack_base_path, metadata_file, entry_point, temp_sub_dir):
    temp_dir_path = "/tmp/%s" % temp_sub_dir
    os.mkdir(temp_dir_path)

# Line 450
def restore_temp_action_files(pack_base_path, metadata_file, entry_point, temp_sub_dir):
    temp_dir_path = "/tmp/%s" % temp_sub_dir

# Line 468
def remove_temp_action_files(temp_sub_dir):
    temp_dir_path = "/tmp/%s" % temp_sub_dir
    if os.path.isdir(temp_dir_path):
        shutil.rmtree(temp_dir_path)

st2common/st2common/util/pack_management.py

# Line 120-123
temp_dir_name = hashlib.md5(
    pack_url.encode(), **hashlib_kwargs
).hexdigest()
lock_file = LockFile("/tmp/%s" % (temp_dir_name))

The lock file path is derived from an MD5 hash of the pack URL, which is predictable and not collision-resistant.

Impact

A local attacker with write access to /tmp/ can:

1. Symlink attack on temp_backup_action_files: Pre-create a symlink at the expected path before os.mkdir is called. If the symlink points to a directory the attacker controls, pack files will be written there, potentially leaking sensitive configuration or entry point code.

2. Symlink attack on restore_temp_action_files: Replace the temp directory with a symlink pointing to attacker-controlled content. When StackStorm restores from the "backup," it copies the attacker's files into the pack directory, achieving arbitrary code execution via a malicious entry point.

3. Lock file manipulation: The predictable lock file path allows an attacker to pre-create the lock file, causing a denial of service (pack installations hang waiting for the lock), or to delete the lock file to cause concurrent pack installations to race.

Recommended Fix

Use tempfile.mkdtemp for all temporary directories:

import tempfile

# Instead of:
temp_dir_path = "/tmp/%s" % temp_sub_dir
os.mkdir(temp_dir_path)

# Use:
temp_dir_path = tempfile.mkdtemp(prefix="st2_pack_backup_")

For the lock file, use a directory under StackStorm's control (e.g., /opt/stackstorm/locks/) rather than /tmp/.

References

• CWE-377: Insecure Temporary File
• CWE-362: Race Condition (TOCTOU)
• Discovered via manual code review