T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:29
- Finding
- Unrestricted Access to Complete Historical Session Logs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29-37`, with supporting search instructions at `SKILL.md:134-139` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Location Session logs live under the active state directory: `$OPENCLAW_STATE_DIR/agents/<agentId>/sessions/` (default: `~/.openclaw/agents/<agentId>/sessions/`). Use the `agent=<id>` value from the system prompt Runtime line. - **`sessions.json`** - Index mapping session keys to session IDs - **`<session-id>.jsonl`** - Full conversation transcript per session ``` The Skill also provides an unrestricted cross-session search operation: ```markdown ### Search across ALL sessions for a phrase ```bash AGENT_ID="<agentId>" SESSION_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}/agents/$AGENT_ID/sessions" rg -l "phrase" "$SESSION_DIR"/*.jsonl ``` ``` ### Technical Analysis The Skill discloses the location and structure of the Agent's complete historical session storage and instructs the Agent to enumerate, search, and extract data from all session transcript files. These transcripts may contain user messages, assistant responses, tool calls, usage information, personal data, confidential business information, or credentials previously supplied during unrelated conversations. The documented operations are read-only and do not exploit an operating-system vulnerability. However, the Skill does not establish authorization or least-privilege controls before accessing unrelated sessions. It lacks: - Verification that the requesting user owns the target session. - Restriction to a specified session or authorized parent-session chain. - Explicit consent before searching complete conversation history. - Separation between providers, users, or conversation contexts. - Filtering of tool calls, internal reasoning records, credentials, or other sensitive content. - Redaction and output-volume controls before matchi ...[truncated 1599 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before accessing historical session files. 2. Restrict retrieval to a user-specified session ID or an authenticated parent-session chain rather than searching every transcript. 3. Verify that the requester owns or is authorized to access the selected session, including sessions originating from other providers. 4. Default to extracting only user-visible text required to answer the request. Exclude tool calls, internal reasoning, metadata, and cost information unless explicitly authorized. 5. Apply secret and personal-data redaction before returning results, covering API keys, tokens, passwords, private keys, email addresses, phone numbers, and similar sensitive values. 6. Add limits for the number of searched sessions, matches, bytes, and returned transcript lines. 7. Require the Agent to summarize relevant context rather than reproduce full transcript passages whenever possible. 8. Record an audit event identifying the requesting user, authorized session scope, query, and files accessed. 9. Replace the unrestricted all-session example with a scoped query, such as: ```bash SESSION_ID="<explicitly-authorized-session-id>" SESSION_FILE="$SESSION_DIR/$SESSION_ID.jsonl" test -f "$SESSION_FILE" && jq -r ' select(.type == "message" and .message.role == "user") | .message.content[]? | select(.type == "text") | .text ' "$SESSION_FILE" | rg --fixed-strings -- "$QUERY" ``` 10. Treat query input strictly as data by using fixed-string matching and `--` argument separation, and validate session identifiers before incorporating them into file paths. ]]>