A temp file can have perfect permissions and still give something away if it sits in a directory anyone can list. CWE-379 covers a product that creates a temporary file in a directory whose permissions let unintended actors learn the file exists or reach it.
MITRE's point: on some operating systems, the mere existence of the file is visible to any user who can list that directory. That reveals which application is running, and what a user is doing right now.
How it happens
The file lands in a shared location such as /tmp or a user's %TEMP% folder. The record shows three real patterns:
- CVE-2022-27818: a hotkey daemon written in Rust creates a domain socket file underneath /tmp, accessible by any user.
- CVE-2021-41989: an analytic platform's repair function uses the %TEMP% folder of a user while running with higher privileges.
- CVE-2021-21290: a Java application used File.createTempFile() to create a random temporary file with insecure default permissions.
What an attacker gains
MITRE lists a confidentiality impact. Someone who can list the process table and the directory can correlate the two and infer a user's activity. From there, MITRE says, higher levels of security could be breached. When the file is a socket or holds data, access to it goes further than a hint.
How to find it
MITRE says static analysis (SAST) can find some instances. Manually, list who can read the directory where your app writes, and check any code path that runs with elevated privileges yet touches a user-writable temp directory.
How to fix it
- Store sensitive temp files in a directory that is not world readable, such as a per-user directory.
- Avoid the vulnerable temp file functions. MITRE notes many modern languages have safe ones, and older C temp file functions are especially susceptible.
- Do not let a privileged process work inside a folder an unprivileged user controls.
import tempfile, os
d = tempfile.mkdtemp() # private directory, mode 700
path = os.path.join(d, "work.dat")
Quick check
The file is mode 600. Is the directory still a problem?
It can be. The name and existence of the file stay visible to anyone who can list the directory, and a socket or lock file in a shared directory can be reached or replaced.
