GameServerManagers / GameServerManagers/LinuxGSM
Security: predictable /tmp/nc_exit_status in postdetails - symlink clobber and TOCTOU
- Dominant language
- Shell
- Stars
- 4.9k
- Forks
- 864
- PR merge metrics
- No merged PRs in 30d
Description
## Security report (responsible disclosure)
### Predictable `/tmp/nc_exit_status` file in postdetails — symlink clobber + write/read race
**Affected:** `lgsm/modules/command_postdetails.sh:63-65`
```bash
nc -w 10 termbin.com 9999
echo $? > /tmp/nc_exit_status
} | tr -d '\n\0')
nc_exit_status=$(cat /tmp/nc_exit_status)
```
Two problems:
1. **Fixed world-writable path with no `mktemp`/`O_EXCL`/noclobber**: a local attacker pre-creates `/tmp/nc_exit_status` as a symlink to a victim-owned file (e.g. `~/.bashrc`). Next time the victim runs `./gameserver pd`, the redirect truncates the target with `0\n` — arbitrary file clobber as the victim user (CWE-59/CWE-377).
2. **TOCTOU between write and read**: an attacker can swap the file contents between line 63 and line 65 to corrupt the status logic; the file is also shared across concurrent LGSM instances.
### Suggested fix
Drop the temp file entirely:
```bash
nc -w 10 termbin.com 9999
nc_exit_status=$?
```
…inside the same command group, or use `mktemp` under `${tmpdir}` if the split is required.
Contributor guide
Research direction
Start in lgsm/modules/command_postdetails.sh around lines 63-65 and inspect the command group that calls termbin.com, writes /tmp/nc_exit_status, and reads it back. Run ./gameserver pd and verify the exit status handling no longer depends on a predictable shared temporary path or a write/read race.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash, shell
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100