Git worktree directories created with chmod 777 (CWE-732)

Summary

When StackStorm creates git worktree directories for pack content versioning, it sets the permissions to 777 (world-readable, world-writable, world-executable). This allows any user on the system to read or tamper with action code before it executes.

Affected File

st2common/st2common/runners/base.py (lines 385-387)

# Make sure system / action runner user can access that directory
args = ["chmod", "777", worktree_path]
cmd = list2cmdline(args)
run_command(cmd=cmd, shell=True)

This also unnecessarily uses shell=True for a simple chmod operation.

Impact

The worktree directory contains the action code that will be executed by the action runner. With 777 permissions:

1. Code tampering: Any local user can modify the action scripts in the worktree between creation and execution, achieving arbitrary code execution in the context of the StackStorm action runner.

2. Information disclosure: Any local user can read the action code, which may contain embedded configuration, API endpoints, or logic that should not be broadly accessible.

3. Race condition: Since the worktree is created and then permissions are set in a separate step, there is a window where the directory exists with its original permissions before being opened up.

Recommended Fix

Use the minimum necessary permissions. The directory only needs to be accessible by the StackStorm system user and the action runner user:

# Use 750 (owner: rwx, group: r-x, other: none) or 770 if group write is needed
args = ["chmod", "750", worktree_path]

Or better, set ownership and permissions atomically:

import os
import stat

os.chmod(worktree_path, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP)  # 750

This also eliminates the need for shell=True and the subprocess call entirely.

References

• CWE-732: Incorrect Permission Assignment for Critical Resource
• Discovered via manual code review

Start with st2common/st2common/runners/base.py at lines 385-387 and trace how the git worktree path is created and passed to chmod. Verify the resulting permissions and command behavior for a worktree, including the absence of shell=True. Done when worktree access is limited to the required users without exposing action code to other local users.