CWE-378 — Creation of Temporary File With Insecure Permissions
CWE-378: Creation of Temporary File With Insecure Permissions
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | High |
Description
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
Common consequences
- Confidentiality: Read Application Data
- Authorization, Other: Other
- Integrity, Other: Other
Mitigations
Requirements — Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
Implementation — Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.
Implementation — Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.
References
- CWE page: https://cwe.mitre.org/data/definitions/378.html
- CWE list: https://cwe.mitre.org/data/index.html