VNX-379: Creation of Temporary File in Directory with Insecure Permissions

Field	Value
Rule ID	VNX-379
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Python
CWE	CWE-379
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	tempfile-insecure-dir cwe-379
Source	internal/sast/rules/vnx-379.rego

Overview

VNX-379 maps to CWE-379: Creation of Temporary File in Directory with Insecure Permissions. It reports:

• os.mkdir()/os.makedirs() with a mode other users can write through (0o777, 0o1777, 0o773, 511, stat.S_IRWXO, stat.S_IWOTH);
• os.chmod() granting other users write to a temporary directory (a /tmp/, /var/tmp/ or /dev/shm/ literal, or a variable assigned from tempfile.mkdtemp()/gettempdir() or such a literal in the 10 lines above);
• a fixed file name in a shared temporary directory opened for writing: open()/io.open() with a w, a or + mode and no x (literal, f-string, or a variable assigned one), Path("/tmp/...").write_text/write_bytes/touch, os.path.join(tempfile.gettempdir(), "name") or os.path.join("/tmp", "name"), Path(tempfile.gettempdir()) / "name", and logging.FileHandler("/tmp/app.log").

Not reported: owner-only or group-only modes (0o700, 0o750, 0o755), chmod of a path that is not a temporary directory, tempfile.mkstemp/NamedTemporaryFile/TemporaryDirectory, reads, writes outside shared temporary directories, comments and string literals. The fixed-name writes overlap VNX-59, which reports them as symlink attacks.

Why This Matters

In a directory every user can write, another user can create the file first, replace it, or point a symlink at a file the program owns. A predictable name in /tmp turns that into a reliable attack.

What Gets Flagged

os.makedirs(UPLOAD_DIR, mode=0o777, exist_ok=True)           # FLAGGED
work = tempfile.mkdtemp()
os.chmod(work, 0o777)                                        # FLAGGED
with open("/tmp/report.json", "w") as fh:                    # FLAGGED
Path("/dev/shm/session.lock").write_text("1")                # FLAGGED
path = os.path.join(tempfile.gettempdir(), "dump.bin")       # FLAGGED
lock = Path(tempfile.gettempdir()) / "worker.lock"           # FLAGGED
handler = logging.FileHandler("/tmp/service.log")            # FLAGGED

Not flagged: os.makedirs(d, mode=0o700), tempfile.NamedTemporaryFile(dir="/tmp"), open("/tmp/report.json") (a read).

Remediation

1. Use tempfile.mkstemp(), NamedTemporaryFile() or TemporaryDirectory(), which create private entries with unpredictable names.
2. Create application directories with mode=0o700 and never widen a temporary directory with chmod.

References

• CWE-379: Creation of Temporary File in Directory with Insecure Permissions
• Python tempfile documentation

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-379
// nosec vnx-379

Or record an ignore rule: vulnetix ignore add --rule vnx-379 --reason "...". See Suppressing findings.