Need

Properly restrict privileges and access modes for temporary files

Context

• Usage of C# for developing robust and efficient software applications
• Usage of System.IO for Input and Output operations in .NET development

Description

Non compliant code

        using System.IO;

public class TempFileCreator
{
    public void CreateTempFile()
    {
        string tempFile = Path.GetTempFileName();
        using (StreamWriter sw = new StreamWriter(tempFile))
        {
            sw.WriteLine("Temporary file content.");
        }
    }
}
        
        

The above C# code snippet represents a class TempFileCreator with a method CreateTempFile(). This method creates a temporary file using the Path.GetTempFileName() method, which automatically generates a unique temporary file in the default system temp directory.

This file is then opened for writing via a StreamWriter object, which writes a line "Temporary file content." to the file.

The vulnerability here lies in the fact that the Path.GetTempFileName() method creates a temporary file with default system permissions, which might not restrict other system users from accessing, modifying, or deleting this file.

An attacker could exploit this vulnerability by gaining access to these temporary files, potentially viewing sensitive information, injecting malicious data, or causing a Denial of Service (DoS) by deleting needed temp files.

This is an example of the "Excessive privileges
- Temporary Files" vulnerability, as the application does not properly restrict the privileges or access modes of the temporary files it creates.

Steps

• Avoid creating temporary files with excessive privileges.
• Use a specific directory for temporary files instead of relying on the system's default temporary directory.
• Set appropriate access permissions for the temporary files to restrict unauthorized access.
• Delete the temporary files after they are no longer needed to prevent them from being used as attack vectors.
• Consider using a library or framework that provides secure temporary file handling mechanisms.

Compliant code

        using System.IO;
using System.Security.AccessControl;
using System.Security.Principal;

public class TempFileCreator
{
    public void CreateTempFile()
    {
        string tempDirectory = Path.Combine(Path.GetTempPath(), "SecureTempFiles");
        Directory.CreateDirectory(tempDirectory);

        string tempFile = Path.Combine(tempDirectory, Path.GetRandomFileName());

        // Set up security rules for the file
        FileSecurity fileSecurity = new FileSecurity();
        fileSecurity.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), FileSystemRights.FullControl, AccessControlType.Deny));

        using (FileStream fs = new FileStream(tempFile, FileMode.CreateNew, FileSystemRights.Write, FileShare.None, 4096, FileOptions.DeleteOnClose, fileSecurity))
        {
            using (StreamWriter sw = new StreamWriter(fs))
            {
                sw.WriteLine("Temporary file content.");
            }
        }
    }
}
        
        

The updated code creates a specific directory for temporary files ( SecureTempFiles) within the system's default temporary directory. This allows for better control over the security settings of the temporary files.

A new temporary file is created within this directory using Path.GetRandomFileName(), which generates a cryptographically strong, random string that can be used as a secure file name.

The FileSecurity object is used to set up access rules for the file. In this case, we're denying FullControl to all users ( WellKnownSidType.WorldSid). This means that no user, including the one running the application, can read, write, or delete the file. This is a very strict rule and might not be suitable for all scenarios. You should adjust the access rules according to your specific needs.

The FileStream is created with the FileOptions.DeleteOnClose option. This means that the file will be automatically deleted when it is closed, i.e., when the StreamWriter is disposed. This ensures that the temporary file is not left behind after it is no longer needed.

Please note that this is a basic example and might not cover all security aspects of temporary file handling. Depending on your specific scenario, you might need to consider additional security measures, such as encrypting the file content or using a secure file shredding mechanism to delete the file.

References

• 160. Excessive privileges - Temporary Files