CVE-2015-1838: Data Processing Errors (CWE-19)
value: modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
CWE description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
CVSS v3 base score: 5.3
Published: 2017-04-13T14:59Z
Repository: https://github.com/saltstack/salt
Language: Python
Files changed: salt/modules/serverdensity_device.py
Commit date: 2015-03-25 14:48:56 -0600
Commit message: Move install.sh to cachedir for serverdensity_device

Diff: diff --git a/salt/modules/serverdensity_device.py b/salt/modules/serverdensity_device.py
index 6040d5cbb..b8f577f70 100644
--- a/salt/modules/serverdensity_device.py
+++ b/salt/modules/serverdensity_device.py
@@ -6,10 +6,12 @@ Wrapper around Server Density API
 .. versionadded:: 2014.7.0
 '''
 import requests
 import json
 import logging
+import os
+import tempfile
 
 from salt.exceptions import CommandExecutionError
 
 log = logging.getLogger(__name__)
 
@@ -214,19 +216,26 @@ def install_agent(agent_key):
 
     .. code-block:: bash
 
         salt '*' serverdensity_device.install_agent c2bbdd6689ff46282bdaa07555641498
     '''
-    work_dir = '/tmp/'
+    work_dir = os.path.join(__opts__['cachedir'], 'tmp')
+    if not os.path.isdir(work_dir):
+        os.mkdir(work_dir)
+    install_file = tempfile.NamedTemporaryFile(dir=work_dir,
+                                                   suffix='.sh',
+                                                   delete=False)
+    install_filename = install_file.name
+    install_file.close()
     account_url = get_sd_auth('account_url')
 
     __salt__['cmd.run'](
-        cmd='curl https://www.serverdensity.com/downloads/agent-install.sh -o install.sh',
+        cmd='curl https://www.serverdensity.com/downloads/agent-install.sh -o {0}'.format(install_filename),
         cwd=work_dir
     )
-    __salt__['cmd.run'](cmd='chmod +x install.sh', cwd=work_dir)
+    __salt__['cmd.run'](cmd='chmod +x {0}'.format(install_filename), cwd=work_dir)
 
     return __salt__['cmd.run'](
-        cmd='./install.sh -a {account_url} -k {agent_key}'.format(
-            account_url=account_url, agent_key=agent_key),
+        cmd='./{filename} -a {account_url} -k {agent_key}'.format(
+            filename=install_filename, account_url=account_url, agent_key=agent_key),
         cwd=work_dir
     )

Vulnerable code:     work_dir = '/tmp/'
        cmd='curl https://www.serverdensity.com/downloads/agent-install.sh -o install.sh',
    __salt__['cmd.run'](cmd='chmod +x install.sh', cwd=work_dir)
        cmd='./install.sh -a {account_url} -k {agent_key}'.format(
            account_url=account_url, agent_key=agent_key),
Fixed code: import os
import tempfile
    work_dir = os.path.join(__opts__['cachedir'], 'tmp')
    if not os.path.isdir(work_dir):
        os.mkdir(work_dir)
    install_file = tempfile.NamedTemporaryFile(dir=work_dir,
                                                   suffix='.sh',
                                                   delete=False)
    install_filename = install_file.name
    install_file.close()
        cmd='curl https://www.serverdensity.com/downloads/agent-install.sh -o {0}'.format(install_filename),
    __salt__['cmd.run'](cmd='chmod +x {0}'.format(install_filename), cwd=work_dir)
        cmd='./{filename} -a {account_url} -k {agent_key}'.format(
            filename=install_filename, account_url=account_url, agent_key=agent_key),