CWE-379 (在具有不安全权限的目录中创建临时文件) — Vulnerability Class 43

CWE-379 represents a critical input validation weakness where applications create temporary files in directories with overly permissive access controls. This flaw allows unintended actors to detect the file’s existence or manipulate its contents, potentially revealing sensitive application logic or user data. Attackers typically exploit this by monitoring the directory for new files, then employing race conditions or symbolic link attacks to redirect the application’s write operations to malicious targets. To mitigate this risk, developers must enforce strict file permissions, ensuring that only the creating process can access the temporary file. Utilizing secure system calls that automatically set restrictive permissions upon creation, such as O_CREAT with mode 0600, is essential. Additionally, storing temporary files in isolated, private directories further reduces the attack surface and prevents unauthorized visibility or interference.