CVE-2026-35367 uutils coreutils nohup信息泄露漏洞

#!/bin/bash # Simulation of the vulnerability in uutils coreutils nohup # This PoC demonstrates that the file permissions are world-readable (0644) # Step 1: Create a file using the vulnerable behavior (simulated) # In a real scenario, the user runs: nohup sensitive_script.sh # Here we simulate the file creation with umask 022 umask 022 echo "SENSITIVE_OUTPUT=SECRET_TOKEN_12345" > nohup.out # Step 2: Check the file permissions # Vulnerable behavior: -rw-r--r-- (0644) # Secure behavior (GNU): -rw------- (0600) echo "Checking permissions of nohup.out:" ls -l nohup.out echo "" echo "Content of nohup.out (readable by any user):" cat nohup.out # Cleanup rm -f nohup.out