Weakness (CWE)
CWE-378: Creation of Temporary File With Insecure Permissions
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
How to prevent it (3 mitigations)
-
Requirements
Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
-
Implementation
Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.
-
Implementation
Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.
Source: MITRE CWE-378
1 result · Clear filters · Feed
-
Medium 5.5CVE-2023-0482 Public exploit
Insecure Temporary File in RESTEasy
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.