Learn about insecure temporary file creation methods that can lead to vulnerabilities. Explore common weaknesses and secure coding practices.

CWE-361: Seven Pernicious Kingdoms - Time and State Handling Vulnerability

CWE-857: Input Output Vulnerabilities

CWE-964: Exposure Temporary File Cluster

CWE-1147: Weaknesses Addressed by the SEI CERT Oracle Secure Coding Standard for Java

CWE-1169: Concurrency Guidelines Vulnerabilities

CWE-1345: Broken Access Control: Weaknesses in OWASP Top Ten (2021)

CWE-1366: Frail Security in Protocols

CWE-1403: Vulnerable Assets

Discover how insecure creation of temporary files can expose systems to attacks. Understand the risks and best practices for secure coding.

CWE-377: Insecure Creation of Temporary Files

There are various methods for creating temporary files in both the C Library and the Windows(R) API, but many of these functions are susceptible to different types of attacks.
The functions used for creating temporary files can be divided into two groups based on whether they simply provide a filename or actually open a new file. The first group, known as "Unique" Filenames, includes functions like tmpnam(), tempnam(), mktemp(), and GetTempFileName(). These functions generate a unique filename for a new temporary file, which the program is then meant to open. However, there is a race condition in this group of functions, as another process or an attacker can create a file with the same name after it is selected but before the application opens it. Additionally, the filenames generated by these functions are not sufficiently random, making it easier for an attacker to guess the filename and potentially inject dangerous data or access, modify, and corrupt the file. On Unix systems, there is a particularly insidious attack where an attacker can create the file as a link to another important file and have the application unknowingly perform damaging operations. While there are some cases where the file can be opened safely using specific flags or attributes, if an attacker can predict the sequence of temporary file names, they can potentially launch a denial of service attack by preventing the application from opening necessary temporary storage.
The second group, known as "Unique" Files, includes functions like tmpfile() and mkstemp(). These functions not only generate a unique filename but also open the file. However, they still have some security issues. For instance, tmpfile() can be vulnerable if an attacker pre-creates the file with relaxed access permissions or as a link to another file. The access permissions applied to the file created by tmpfile() can also vary across different operating systems, potentially leaving application data vulnerable. On the other hand, mkstemp() is a relatively safer option as it attempts to create and open a unique file based on a provided filename template and randomly generated characters. It returns an error if it fails to create the file, and the file is opened with secure access permissions. However, mkstemp() still suffers from predictable filenames, which can be exploited by an attacker to cause denial of service attacks.


CWE-377: Insecure Temporary File Creation

Is your System Free of Underlying Vulnerabilities?
Find Out Now

CWE-377: Insecure Temporary File Creation

Is your System Free of Underlying Vulnerabilities? Find Out Now

Is your System Free of Underlying Vulnerabilities?
Find Out Now