T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/create.py:114- Finding
Nested Symbolic Links Can Cause Unauthorized File Collection
- Content
View full analysis
sub/{skill_name}/") ``` ### Technical Analysis The script validates only the top-level source and destination paths. This prevents direct path traversal through command-line skill names, but it does not inspect entries located inside the source skill directory. Python's `shutil.copytree()` uses `symlinks=False` by default. Consequently, symbolic links encountered within the source tree are dereferenced, and the contents of their targets are copied rather than preserving the links. A source skill can therefore contain a symbolic link targeting a file or directory outside `SKILLS_DIR`. The `safe_path()` check does not prevent this condition because it runs before recursive copying and only evaluates the explicitly constructed root paths. It does not validate every object traversed by `copytree()`. ### Attack Path 1. An attacker creates or supplies a skill directory under the skills root. 2. The skill contains a symbolic link pointing to a sensitive file or directory accessible to the user running the script. 3. A victim invokes either: - `create.py create ...` with the c ...[truncated 959 chars]- Remediation
View remediation
None: for entry in root.rglob("*"): if entry.is_symlink(): raise ValueError(f"Symbolic links are not permitted: {entry}") ``` Call this validation immediately before every `copytree()` operation. 2. If symbolic links must be supported, use: ```python shutil.copytree(src, dest, symlinks=True) ``` This preserves links instead of copying target contents. Retained links must still be validated or removed before packaging or distribution because they may resolve outside the package when later consumed. 3. Validate the complete source tree using `os.lstat()` so validation does not itself follow symbolic links. 4. Apply a fail-closed policy: abort the entire operation if a symbolic link, special device, socket, FIFO, or other unsupported filesystem object is detected. 5. Add regression tests covering links to: - Files outside `SKILLS_DIR` - Directories outside `SKILLS_DIR` - Broken links - Relative links containing parent-directory components - Multi-hop symbolic-link chains ]]>