GameServerManagers / GameServerManagers/LinuxGSM

Security: predictable /tmp/nc_exit_status in postdetails - symlink clobber and TOCTOU

Open Beginner friendly
#4,956 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
4.9k
Forks
864
PR merge metrics
No merged PRs in 30d

Description

## Security report (responsible disclosure)

### Predictable `/tmp/nc_exit_status` file in postdetails — symlink clobber + write/read race

**Affected:** `lgsm/modules/command_postdetails.sh:63-65`

```bash
nc -w 10 termbin.com 9999
echo $? > /tmp/nc_exit_status
} | tr -d '\n\0')
nc_exit_status=$(cat /tmp/nc_exit_status)
```

Two problems:

1. **Fixed world-writable path with no `mktemp`/`O_EXCL`/noclobber**: a local attacker pre-creates `/tmp/nc_exit_status` as a symlink to a victim-owned file (e.g. `~/.bashrc`). Next time the victim runs `./gameserver pd`, the redirect truncates the target with `0\n` — arbitrary file clobber as the victim user (CWE-59/CWE-377).
2. **TOCTOU between write and read**: an attacker can swap the file contents between line 63 and line 65 to corrupt the status logic; the file is also shared across concurrent LGSM instances.

### Suggested fix

Drop the temp file entirely:

```bash
nc -w 10 termbin.com 9999
nc_exit_status=$?
```

…inside the same command group, or use `mktemp` under `${tmpdir}` if the split is required.

Contributor guide

Open the contributing guide

Research direction

Start in lgsm/modules/command_postdetails.sh around lines 63-65 and inspect the command group that calls termbin.com, writes /tmp/nc_exit_status, and reads it back. Run ./gameserver pd and verify the exit status handling no longer depends on a predictable shared temporary path or a write/read race.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, shell
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.