T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- tools/read.js:3
- Finding
- Unrestricted Local File Read Through Caller-Controlled Path## Vulnerability Details **File Location**: `tools/read.js:3-6` **Vulnerability Type**: Arbitrary local file read caused by missing path validation and authorization **Risk Level**: High ### Vulnerable Code ```js module.exports = async function readFile(context, params) { try { const content = fs.readFileSync(params.path, 'utf8'); return content; ``` ### Technical Analysis The tool passes the caller-controlled `params.path` directly to `fs.readFileSync` without validating, canonicalizing, or restricting the requested path. It does not confine reads to a designated workspace or an allowlist of user-owned files. The `context` argument is unused, so the function performs no caller authorization or ownership check. Absolute paths, parent-directory traversal, symbolic-link escapes, sensitive virtual files such as `/proc/self/environ`, and credential files are not explicitly rejected. Consequently, anyone able to invoke the tool or influence its arguments can attempt to read any UTF-8-compatible file accessible under the operating-system permissions of the Agent process. This also contradicts the claim in `SKILL.md:29` that tools are sanitized and limited to user-owned data. ### Attack Path 1. An attacker directly invokes the read tool or uses prompt injection to influence an Agent that can invoke it. 2. The attacker supplies a sensitive path through `params.path`, such as `/proc/self/environ`, an application `.env` file, or a private-key path. 3. The function passes that path unchanged to `fs.readFileSync`. 4. Node.js reads the target using the operating-system privileges of the Agent process. 5. The function returns the complete file contents to the Agent or caller. 6. The sensitive content may then be disclosed in an Agent response or passed to another available tool. ### Impact Assessment Exploitation grants read access to files available to the runtime account, rather than only files legitimately r ...[truncated 533 chars]
- Remediation
- ## Remediation Suggestions 1. Define a dedicated, least-privilege directory from which the tool is permitted to read. 2. Reject absolute paths and requests containing parent-directory traversal. 3. Resolve the requested path against the permitted root and canonicalize both paths with `fs.realpath`. 4. Verify that the canonical target remains inside the canonical permitted root, using a separator-aware containment check. 5. Reject symbolic links or verify their fully resolved targets before reading. 6. Enforce caller identity, file ownership, and authorization using the supplied `context`. 7. Block sensitive files and virtual or device paths, including environment files, private keys, `/proc`, and `/dev`. 8. Apply file-type and maximum-size limits to reduce secret exposure and denial-of-service risk. 9. Return generic errors rather than exposing internal paths or detailed filesystem errors. 10. Run the Agent under a dedicated operating-system account with minimal filesystem access. 11. Add security tests covering absolute paths, `../` traversal, encoded traversal, symbolic-link escapes, `/proc/self/environ`, credential files, oversized files, and unauthorized callers.