Security: predictable /tmp/nc_exit_status in postdetails - symlink clobber and TOCTOU

[Pajt9whauht283as]

Security report (responsible disclosure)

Predictable /tmp/nc_exit_status file in postdetails — symlink clobber + write/read race

Affected: lgsm/modules/command_postdetails.sh:63-65

	nc -w 10 termbin.com 9999
	echo $? > /tmp/nc_exit_status
} | tr -d '\n\0')
nc_exit_status=$(cat /tmp/nc_exit_status)

Two problems:

1. Fixed world-writable path with no mktemp/O_EXCL/noclobber: a local attacker pre-creates /tmp/nc_exit_status as a symlink to a victim-owned file (e.g. ~/.bashrc). Next time the victim runs ./gameserver pd, the redirect truncates the target with 0\n — arbitrary file clobber as the victim user (CWE-59/CWE-377).
2. TOCTOU between write and read: an attacker can swap the file contents between line 63 and line 65 to corrupt the status logic; the file is also shared across concurrent LGSM instances.

Suggested fix

Drop the temp file entirely:

nc -w 10 termbin.com 9999
nc_exit_status=$?

…inside the same command group, or use mktemp under ${tmpdir} if the split is required.