Impact
Kotlin Stdlib is vulnerable to CWE-378 - Insecure Temporary File & CWE-379 - Creation of Temporary File in Directory with Insecure Permissions.
These are the two vulnerable locations:
Here is a simple unit test that demonstrates the vulnerability.
package org.jlleitschuh.sandbox
import org.junit.jupiter.api.Test
import java.io.BufferedReader
import java.io.File
import java.io.IOException
import java.io.InputStreamReader
import java.nio.file.Files
class KotlinTempDirectoryPermissionCheck {
@Test
fun `kotlin check default directory permissions`() {
val dir = createTempDir()
runLS(dir.parentFile, dir) // Prints drwxr-xr-x
}
@Test
fun `Files check default directory permissions`() {
val dir = Files.createTempDirectory("random-directory")
runLS(dir.toFile().parentFile, dir.toFile()) // Prints drwx------
}
@Test
fun `kotlin check default file permissions`() {
val file = createTempFile()
runLS(file.parentFile, file) // Prints -rw-r--r--
}
@Test
fun `Files check default file permissions`() {
val file = Files.createTempFile("random-file", ".txt")
runLS(file.toFile().parentFile, file.toFile()) // Prints -rw-------
}
private fun runLS(file: File, lookingFor: File) {
val processBuilder = ProcessBuilder()
processBuilder.command("ls", "-l", file.absolutePath)
try {
val process = processBuilder.start()
val output = StringBuilder()
val reader = BufferedReader(
InputStreamReader(process.inputStream)
)
reader.lines().forEach { line ->
if (line.contains("total")) {
output.append(line).append('\n')
}
if (line.contains(lookingFor.name)) {
output.append(line).append('\n')
}
}
val exitVal = process.waitFor()
if (exitVal == 0) {
println("Success!")
println(output)
} else {
//abnormal...
}
} catch (e: IOException) {
e.printStackTrace()
} catch (e: InterruptedException) {
e.printStackTrace()
}
}
}
A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.
Prerequisites
This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.
Patches
There are no patched versions with this vulnerability fixed. All versions remain vulnerable. However, the impacted methods have been deprecated.
To fully mitigate this vulnerability, ensure your code and all dependencies don't use the createTempFile
or createTempFile
methods offered by the Kotlin standard library.
Workarounds
Setting the java.io.tmpdir
system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems and all Kotlin versions.
Depending upon the version of android you are using, this may also impact you. See the following resource: google/guava#4011 (comment)
References
JetBrains does a really terrible job with fully disclosing the details of their own vulnerabilities unfortunately.
For more information
Reach out to Jetbrains: [email protected]
Impact
Kotlin Stdlib is vulnerable to CWE-378 - Insecure Temporary File & CWE-379 - Creation of Temporary File in Directory with Insecure Permissions.
These are the two vulnerable locations:
Here is a simple unit test that demonstrates the vulnerability.
A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.
Prerequisites
This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.
Patches
There are no patched versions with this vulnerability fixed. All versions remain vulnerable. However, the impacted methods have been deprecated.
To fully mitigate this vulnerability, ensure your code and all dependencies don't use the
createTempFile
orcreateTempFile
methods offered by the Kotlin standard library.Workarounds
Setting the
java.io.tmpdir
system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems and all Kotlin versions.Depending upon the version of android you are using, this may also impact you. See the following resource: google/guava#4011 (comment)
References
JetBrains does a really terrible job with fully disclosing the details of their own vulnerabilities unfortunately.
For more information
Reach out to Jetbrains: [email protected]