932
In the following code examples a temporary file is created and written to. After using the temporary
file, the file is closed and deleted from the file system.
Example Language: C (Bad)
FILE *stream;
if( (stream = tmpfile()) == NULL ) {
perror("Could not open new temporary file\n");
return (-1);
}
// write data to tmp file
...
// remove tmp file
rmtmp();
However, within this C/C++ code the method tmpfile() is used to create and open the temp file.
The tmpfile() method works the same way as the fopen() method would with read/write permission,
allowing attackers to read potentially sensitive information contained in the temp file or modify the
contents of the file.
Example Language: Java (Bad)
try {
File temp = File.createTempFile("pattern", ".suffix");
temp.deleteOnExit();
BufferedWriter out = new BufferedWriter(new FileWriter(temp));
out.write("aString");
out.close();
}
catch (IOException e) {
}
Similarly, the createTempFile() method used in the Java code creates a temp file that may be
readable and writable to all users.
Additionally both methods used above place the file into a default directory. On UNIX systems the
default directory is usually "/tmp" or "/var/tmp" and on Windows systems the default directory is
usually "C:\\Windows\\Temp", which may be easily accessible to attackers, possibly enabling them
to read and modify the contents of the temp file.
Observed Examples
Reference Description
CVE-2022-27818 A hotkey daemon written in Rust creates a domain socket file underneath /tmp,
which is accessible by any user.
https://www.cve.org/CVERecord?id=CVE-2022-27818
CVE-2021-21290 A Java-based application for a rapid-development framework uses
File.createTempFile() to create a random temporary file with insecure default
permissions.
https://www.cve.org/CVERecord?id=CVE-2021-21290
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
CWE Version 4.14
CWE-382: J2EE Bad Practices: Use of System.exit()
CWE-382: J2EE Bad Practices: Use of System.exit()