Skip to content

Race Condition vulnerability #135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Conversation

th555555
Copy link

This PR fixes a race condition vulnerability in the createTempDirectory method that could allow attackers to exploit the gap between file deletion and directory creation

Problem
The original implementation used an unsafe pattern:

  1. Create a temporary file with File.createTempFile()
  2. Delete the file with temp.delete()
  3. Create a directory with the same name using temp.mkdir()

This creates a window where an attacker could:

  • Create a symbolic link pointing to sensitive directories
  • Create files/directories they control
  • Potentially escalate privileges or access unauthorized resources

Solution
Replace the unsafe temporary directory creation with Files.createTempDirectory() from Java NIO.2, which creates directories atomically and securely without the race condition

References:
https://cwe.mitre.org/data/definitions/362.html
UniversaBlockchain/universa@1e34b18

This PR fixes a race condition vulnerability in the createTempDirectory method that could allow attackers to exploit the gap between file deletion and directory creation

Problem
The original implementation used an unsafe pattern:

Create a temporary file with File.createTempFile()
Delete the file with temp.delete()
Create a directory with the same name using temp.mkdir()

This creates a window where an attacker could:

Create a symbolic link pointing to sensitive directories
Create files/directories they control
Potentially escalate privileges or access unauthorized resources

Solution
Replace the unsafe temporary directory creation with Files.createTempDirectory() from Java NIO.2, which creates directories atomically and securely without the race condition

References:
https://cwe.mitre.org/data/definitions/362.html
UniversaBlockchain/universa@1e34b18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant