T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- send-image.sh:8
- Finding
- Workspace Path Traversal Can Expose Images Outside the Intended Directory<![CDATA[ ## Vulnerability Details **File Location**: `send-image.sh`, lines 8-25 **Vulnerability Type**: Path traversal and insufficient filesystem boundary validation **Risk Level**: Medium ### Vulnerable Code ```bash WORKSPACE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}" IMAGE_NAME="$1" MESSAGE="${2:-发送图片}" # Check arguments if [ -z "$IMAGE_NAME" ]; then exit 1 fi # Build the complete path IMAGE_PATH="$WORKSPACE/$IMAGE_NAME" # Check whether the file exists if [ ! -f "$IMAGE_PATH" ]; then exit 1 fi ``` The resulting path is subsequently included in the generated messaging instruction: ```bash echo "message({" echo " action: \"send\"," echo " channel: \"feishu\"," echo " message: \"$MESSAGE\"," echo " media: \"$IMAGE_PATH\"" echo "})" ``` ### Technical Analysis The script concatenates the caller-controlled `IMAGE_NAME` directly with the configured workspace path. It does not canonicalize the resulting path or verify that the canonical target remains beneath the canonical workspace directory. The `-f` check only verifies that the resulting path resolves to a regular file. It does not prevent traversal components such as `../`, nor does it prevent a symbolic link inside the workspace from resolving to a file outside the workspace. For example, an input resembling the following can resolve outside the intended directory: ```text ../../private/secret.png ``` If the resolved target exists, is readable by the OpenClaw process, and has one of the permitted filename extensions, the script accepts it and prints its path as the `media` value of a Feishu message instruction. The script does not itself transmit the file. Exploitation therefore requires an Agent or operator to execute the generated instruction. Nevertheless, the generated instruction incorrectly represents an out-of-workspace file as an approved media attachment. ### Attack Path 1. An attacker or untrusted caller supplies an image name containing directory traversal compon ...[truncated 1255 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Canonicalize both the workspace and selected file with `realpath`. 2. Verify that the canonical file path is strictly beneath the canonical workspace path. 3. Reject absolute paths and filename inputs containing directory components if only top-level workspace files are intended. 4. Resolve symbolic links before performing the containment check. 5. Perform the regular-file and extension checks against the canonical target. 6. Avoid relying solely on a filename extension to establish that a file is a valid image. Validate the file's MIME type or decode it with a trusted image library before upload. A hardened containment pattern could resemble: ```bash WORKSPACE_REAL="$(realpath -e -- "$WORKSPACE")" IMAGE_PATH_REAL="$(realpath -e -- "$WORKSPACE/$IMAGE_NAME")" case "$IMAGE_PATH_REAL" in "$WORKSPACE_REAL"/*) ;; *) echo "Error: selected file is outside the workspace" >&2 exit 1 ;; esac if [ ! -f "$IMAGE_PATH_REAL" ]; then echo "Error: selected path is not a regular file" >&2 exit 1 fi ``` If nested directories are unnecessary, additionally require: ```bash if [ "$IMAGE_NAME" != "$(basename -- "$IMAGE_NAME")" ]; then echo "Error: only a filename is permitted" >&2 exit 1 fi ``` ]]>