Merge pull request #17 from JLLeitschuh/feat/temporary-file-local-inf…

…ormation-disclosure
JLLeitschuh · Nov 18, 2022 · 36f8dcf · 36f8dcf
2 parents 86b86f7 d495937
commit 36f8dcf
Show file tree

Hide file tree

Showing 5 changed files with 122 additions and 5 deletions.
diff --git a/bulk-pr-generation/temporary-directory-hijacking/pr_message.md b/bulk-pr-generation/temporary-directory-hijacking/pr_message.md
@@ -15,8 15,8 @@ This PR was generated because the following chain of calls was detected in this
 
 This vulnerability can have one of two impacts depending upon which vulnerability it is.
 
- 1. Temporary Directory Information Disclosure - Information in this directory is visable to other local users, allowing a malicious actor co-resident on the same machine to view potentially sensitive files.
- 2. Temporary Directory Hijacking Vulnerability - Same impact as 1. above, but also, ther local users can manipulate/add contents to this directory. If code is being executed out of this temporary directory, it can lead to local priviledge escalation.
  1. Temporary Directory Information Disclosure - Information in this directory is visible to other local users, allowing a malicious actor co-resident on the same machine to view potentially sensitive files.
  2. Temporary Directory Hijacking Vulnerability - Same impact as 1. above, but also, local users can manipulate/add contents to this directory. If code is being executed out of this temporary directory, it can lead to local privilege escalation.
 
 ## Temporary Directory Hijacking
 
@@ -59,13 59,13 @@ if (!tmpDir.mkdirs()) { // Guard correctly prevents temporary directory hijackin
 
 # The Fix
 
-The fix has been to convert the logic above to use the following API that was introduced in Java 1.7.
 The fix is to convert the logic above to use the following API that was introduced in Java 1.7.
 
 ```java
 File tmpDir = Files.createTempDirectory("temp dir").toFile();
 ```
 
-The API both created the directory securely, ie with a random, non-conflicting name, with directory permissions that only allow the currently executing user to read or write the contents of this directory.
 The API both creates the directory securely, ie. with a random, non-conflicting name, with directory permissions that only allow the currently executing user to read or write the contents of this directory.
 
 # :arrow_right: Vulnerability Disclosure :arrow_left:
 
@@ -118,7 118,7 @@ _This section is only relevant if your project requires contributors to sign a C
 
 It is unlikely that I'll be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.
 
-> The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin 
 > The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin
 > (see [https://developercertificate.org/](https://developercertificate.org/) for more information).
 >
 > \- [Git Commit Signoff documentation](https://developercertificate.org/)

diff --git a/bulk-pr-generation/temporary-file-local-information-disclosure/branch_name.txt b/bulk-pr-generation/temporary-file-local-information-disclosure/branch_name.txt
@@ -0,0 1 @@
 fix/JLL/temporary_file_local_information_disclosure
diff --git a/bulk-pr-generation/temporary-file-local-information-disclosure/commit.txt b/bulk-pr-generation/temporary-file-local-information-disclosure/commit.txt
@@ -0,0 1,15 @@
 vuln-fix: Temporary File Information Disclosure
 
 This fixes temporary file information disclosure vulnerability due to the use
 of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
 using the `Files.createTempFile()` method which sets the correct posix permissions.
 
 Weakness: CWE-377: Insecure Temporary File
 Severity: Medium
 CVSSS: 5.5
 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
 
 Reported-by: Jonathan Leitschuh <[email protected]>
 Signed-off-by: Jonathan Leitschuh <[email protected]>
 
 Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
diff --git a/bulk-pr-generation/temporary-file-local-information-disclosure/pr_message.md b/bulk-pr-generation/temporary-file-local-information-disclosure/pr_message.md
@@ -0,0 1,100 @@
 [SECURITY] Fix Temporary File Information Disclosure Vulnerability
 
 # Security Vulnerability Fix
 
 This pull request fixes a Temporary File Information Disclosure Vulnerability, which existed in this project.
 
 ## Preamble
 
 The system temporary directory is shared between all users on most unix-like systems (not MacOS, or Windows). Thus, code interacting with the system temporary directory must be careful about file interactions in this directory, and must ensure that the correct file posix permissions are set.
 
 This PR was generated because a call to `File.createTempFile(..)` was detected in this repository in a way that makes this project vulnerable.
 
 ### Impact
 
 Information in this file is visible to other local users, allowing a malicious actor co-resident on the same machine to view potentially sensitive files.
 
 #### Other Examples
 
  - [CVE-2020-15250](https://github.com/advisories/GHSA-269g-pwp5-87pp) - junit-team/junit
  - [CVE-2021-21364](https://github.com/advisories/GHSA-hpv8-9rq5-hq7w) - swagger-api/swagger-codegen
  - [CVE-2022-24823](https://github.com/advisories/GHSA-5mcr-gq6c-3hq2) - netty/netty
  - [CVE-2022-24823](https://github.com/advisories/GHSA-269q-hmxg-m83q) - netty/netty
 
 # The Fix
 
 The fix has been to convert the logic above to use the following API that was introduced in Java 1.7.
 
 ```java
 File tmpDir = Files.createTempFile("temp dir").toFile();
 ```
 
 The API both creates the file securely, ie. with a random, non-conflicting name, with file permissions that only allow the currently executing user to read or write the contents of this file.
 
 # :arrow_right: Vulnerability Disclosure :arrow_left:
 
 :wave: Vulnerability disclosure is a super important part of the vulnerability handling process and should not be skipped! This may be completely new to you, and that's okay, I'm here to assist!
 
 First question, do we need to perform vulnerability disclosure? It depends!
 
  1. Is the vulnerable code only in tests or example code? No disclosure required!
  2. Is the vulnerable code in code shipped to your end users? Vulnerability disclosure is probably required!
 
 ## Vulnerability Disclosure How-To
 
 You have a few options options to perform vulnerability disclosure. However, I'd like to suggest the following 2 options:
 
  1. Request a CVE number from GitHub by creating a repository-level [GitHub Security Advisory](https://docs.github.com/en/code-security/repository-security-advisories/creating-a-repository-security-advisory). This has the advantage that, if you provide sufficient information, GitHub will automatically generate Dependabot alerts for your downstream consumers, resolving this vulnerability more quickly.
  2. Reach out to the team at Snyk to assist with CVE issuance. They can be reached at the [Snyk's Disclosure Email](mailto:[email protected]).
 
 ## Detecting this and Future Vulnerabilities
 
 This vulnerability was automatically detected by GitHub's CodeQL using this [CodeQL Query](https://codeql.github.com/codeql-query-help/java/java-local-temp-file-or-directory-information-disclosure/).
 
 You can automatically detect future vulnerabilities like this by enabling the free (for open-source) [GitHub Action](https://github.com/github/codeql-action).
 
 I'm not an employee of GitHub, I'm simply an open-source security researcher.
 
 ## Source
 
 This contribution was automatically generated with an [OpenRewrite](https://github.com/openrewrite/rewrite) [refactoring recipe](https://docs.openrewrite.org/), which was lovingly hand crafted to bring this security fix to your repository.
 
 The source code that generated this PR can be found here:
 [SecureTempFileCreation](https://github.com/openrewrite/rewrite-java-security/blob/main/src/main/java/org/openrewrite/java/security/SecureTempFileCreation.java)
 
 ## Opting-Out
 
 If you'd like to opt-out of future automated security vulnerability fixes like this, please consider adding a file called
 `.github/GH-ROBOTS.txt` to your repository with the line:
 
 ```
 User-agent: JLLeitschuh/security-research
 Disallow: *
 ```
 
 This bot will respect the [ROBOTS.txt](https://moz.com/learn/seo/robotstxt) format for future contributions.
 
 Alternatively, if this project is no longer actively maintained, consider [archiving](https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-archiving-repositories) the repository.
 
 ## CLA Requirements
 
 _This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions._
 
 It is unlikely that I'll be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.
 
 > The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin
 > (see [https://developercertificate.org/](https://developercertificate.org/) for more information).
 >
 > \- [Git Commit Signoff documentation](https://developercertificate.org/)
 
 If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.
 
 ## Sponsorship & Support
 
 This contribution is sponsored by HUMAN Security Inc. and the new Dan Kaminsky Fellowship, a fellowship created to celebrate Dan's memory and legacy by funding open-source work that makes the world a better (and more secure) place.
 
 This PR was generated by [Moderne](https://www.moderne.io/), a free-for-open source SaaS offering that uses format-preserving AST transformations to fix bugs, standardize code style, apply best practices, migrate library versions, and fix common security vulnerabilities at scale.
 
 ## Tracking
 
 All PR's generated as part of this fix are tracked here: https://github.com/JLLeitschuh/security-research/issues/18
diff --git a/bulk-pr-generation/temporary-file-local-information-disclosure/recipe.txt b/bulk-pr-generation/temporary-file-local-information-disclosure/recipe.txt
@@ -0,0 1 @@
 org.openrewrite.java.security.SecureTempFileCreation