T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/lock-done.sh:21
- Finding
- Missing authorization allows arbitrary tasks to be marked complete and archived<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lock-done.sh:21-45` **Vulnerability Type**: Missing authorization check **Risk Level**: High ### Vulnerable Code ```bash # Find lock if [[ -z "$AGENT_ID" ]]; then AGENT_SEARCH=$(find "$LOCKS_ROOT" -name "${TASK_ID}.lock" -type f 2>/dev/null | head -1) [[ -z "$AGENT_SEARCH" ]] && { echo "Error: lock not found: $TASK_ID"; exit 1; } AGENT_ID=$(echo "$AGENT_SEARCH" | sed "s|$LOCKS_ROOT/||" | cut -d/ -f1) fi LOCK_FILE="$LOCKS_ROOT/$AGENT_ID/locks/active/${TASK_ID}.lock" [[ ! -f "$LOCK_FILE" ]] && LOCK_FILE=$(find "$LOCKS_ROOT/$AGENT_ID/locks" -name "${TASK_ID}.lock" -type f 2>/dev/null | head -1) [[ ! -f "$LOCK_FILE" ]] && { echo "Error: lock does not exist: $TASK_ID"; exit 1; } # Check status CURRENT_STATUS=$(grep -o '"status"[[:space:]]*:[[:space:]]*"[^"]*"' "$LOCK_FILE" | sed 's/.*: *"\([^"]*\)".*/\1/') [[ "$CURRENT_STATUS" == "done" ]] && { echo "Note: already done: $TASK_ID"; exit 0; } DONE_AT=$(date -u +"%Y-%m-%dT%H:%M:%S+08:00") # Update status sed -i 's/"status": "[^"]*"/"status": "done"/' "$LOCK_FILE" sed -i "s/\"done_at\": \"[^\"]*\"/\"done_at\": \"$DONE_AT\"/" "$LOCK_FILE" # Archive immediately ARCHIVE_DIR="$LOCKS_ROOT/$AGENT_ID/locks/archive/$(date +%Y-%m-%d)" mkdir -p "$ARCHIVE_DIR" mv "$LOCK_FILE" "$ARCHIVE_DIR/" ``` ### Technical Analysis The completion operation locates a lock solely by a caller-supplied task and optional agent identifier. It then modifies and moves the lock without authenticating the caller or comparing the caller's session with the lock's `session_id`. This contradicts the ownership model documented in `references/spec.md:80-101`, which requires owner-session validation or an authorized takeover decision. Filesystem permissions alone do not establish task-level ownership when multiple agents or sessions execute under the same operating-system account. ### Attack Path 1. An attacker with permission to invoke the script identifies or guesses another tas ...[truncated 703 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require a trusted current-session identity for every state-changing operation. - Read the lock owner's `session_id` and compare it using exact string equality. - Fail closed if either the current identity or lock owner is absent or malformed. - Permit takeover only after a reliable, structured session-liveness check. - Do not accept privileged identities such as `main` or `dispatcher` from untrusted command-line arguments or environment variables. - Centralize authorization in a shared helper used by both `lock-update.sh` and `lock-done.sh`. - Revalidate authorization immediately before the final write and move to reduce race conditions. ]]>