Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.
CWE-378 Base Draft
Creation of Temporary File With Insecure Permissions
This vulnerability occurs when a program creates a temporary file but sets its file permissions too loosely, allowing other users or processes on the system to read, modify, or delete the file.
Definition
What is CWE-378?
This vulnerability occurs when a program creates a temporary file but sets its file permissions too loosely, allowing other users or processes on the system to read, modify, or delete the file.
When a temporary file is created with insecure permissions (like world-readable or world-writable), it becomes an easy target for attackers on the same system. They can directly read sensitive data from the file, inject malicious content into it, or even delete it to cause a denial of service. This is especially dangerous because developers often assume temporary files are private and secure, leading them to store sensitive information like session tokens, passwords, or configuration data in them.
To prevent this, always use secure APIs designed for temporary file creation that enforce strict permissions by default, such as `mkstemp` on Unix-like systems. If you must use a lower-level function, explicitly set restrictive file permissions immediately after creation. Additionally, consider using alternative, more secure storage methods like memory-based structures for highly sensitive data, and ensure proper file cleanup to reduce the attack window.
Auswirkungen in der Praxis
Real-world CVEs caused by CWE-378
-
A network application framework uses the Java function createTempFile(), which will create a file that is readable by other local users of the system
Wie Angreifer es ausnutzen
Angreiferpfad Schritt für Schritt
- 1
In the following code examples a temporary file is created and written to. After using the temporary file, the file is closed and deleted from the file system.
- 2
However, within this C/C++ code the method tmpfile() is used to create and open the temp file. The tmpfile() method works the same way as the fopen() method would with read/write permission, allowing attackers to read potentially sensitive information contained in the temp file or modify the contents of the file.
- 3
Similarly, the createTempFile() method used in the Java code creates a temp file that may be readable and writable to all users.
- 4
Additionally both methods used above place the file into a default directory. On UNIX systems the default directory is usually "/tmp" or "/var/tmp" and on Windows systems the default directory is usually "C:\\Windows\\Temp", which may be easily accessible to attackers, possibly enabling them to read and modify the contents of the temp file.
Verwundbares Codebeispiel
Vulnerable C
In the following code examples a temporary file is created and written to. After using the temporary file, the file is closed and deleted from the file system.
FILE *stream;
if( (stream = tmpfile()) == NULL ) {
perror("Could not open new temporary file\n");
return (-1);
}
```
// write data to tmp file*
...
// remove tmp file
rmtmp(); Sicheres Codebeispiel
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste
How to prevent CWE-378
- Requirements Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
- Implementation Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.
- Implementation Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.
Erkennungssignale
How to detect CWE-378
Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.
Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.
Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.
CWE-378
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Häufig gestellte Fragen Was ist CWE-378?
Wie gravierend ist CWE-378?
Welche Sprachen oder Plattformen sind von CWE-378 betroffen?
Wie kann ich CWE-378 verhindern?
Wie erkennt und behebt Plexicus CWE-378?
Wo erfahre ich mehr über CWE-378?
Frequently asked questions
Was ist CWE-378?
This vulnerability occurs when a program creates a temporary file but sets its file permissions too loosely, allowing other users or processes on the system to read, modify, or delete the file.
Wie gravierend ist CWE-378?
MITRE stuft die Exploit-Wahrscheinlichkeit als hoch ein — diese Schwachstelle wird aktiv in freier Wildbahn ausgenutzt und sollte priorisiert behoben werden.
Welche Sprachen oder Plattformen sind von CWE-378 betroffen?
MITRE hat für diese CWE keine betroffenen Plattformen spezifiziert — sie kann in den meisten Anwendungs-Stacks auftreten.
Wie kann ich CWE-378 verhindern?
Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible. Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.
Wie erkennt und behebt Plexicus CWE-378?
Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-378 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.
Wo erfahre ich mehr über CWE-378?
MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/378.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.
Verwandte Schwachstellen
Weaknesses related to CWE-378
CWE-377 Parent
Insecure Temporary File
This vulnerability occurs when an application creates temporary files with insecure permissions or in predictable locations, allowing…
CWE-379 Sibling
Creation of Temporary File in Directory with Insecure Permissions
This vulnerability occurs when an application creates a temporary file in a directory that is too permissive, allowing unauthorized users…
Bereit, das Wesentliche zu validieren?
Bereit zu validieren, was zählt.
Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.