T05 · Unauthorized Access and Privilege Escalation
Error
- Location
shuguang_hybrid_memory.py:280- Finding
Scope Filtering Bypass in Hybrid Memory Recall
- Content
View full analysis
List[Dict]: """ 混合检索回忆 流程: 1. 向量搜索 (语义相似度) 2. BM25搜索 (关键词匹配) 3. 分数融合 (0.7*向量 + 0.3*BM25) 4. Weibull衰减加权 5. 过滤低分记忆 """ query_vec = self._simple_vectorize(query) # 1. 向量搜索 vector_scores = {} for eid, entry in self.entries.items(): if scope and entry.scope != scope: continue if entry.vector: sim = self._cosine_similarity(query_vec, entry.vector) vector_scores[eid] = sim # 2. BM25搜索 bm25_results = self.bm25.search(query, top_k=max(top_k * 3, 20)) bm25_scores = {eid: score for eid, score in bm25_results} # 3. 分数融合 + 衰减加权 combined = {} all_ids = set(vector_scores.keys()) | set(bm25_scores.keys()) for eid in all_ids: entry = self.entries.get(eid) if not entry: continue v_score = vector_scores.get(eid, 0.0) b_score = bm25_scores.get(eid, 0.0) ``` ### Technical Analysis The `scope` restriction is applied only while calculating vector-search scores. The BM25 index searches all stored documents without applying the requested scope. The code subsequently forms `all_ids` by taking the union of the scope-filtered vector IDs and the unfiltered BM25 IDs. A memory entry excluded from vector search because it belongs to another scope can therefore be reintroduced by BM25 and processed as a valid result. This breaks the apparent access-control boundary represented by the `global`, `agent`, `project`, and `user` scopes. The flaw is particularly significant if a single `memory_store.json` is shared among users, agents, or projects that are not mutually trusted. ### Attack Path 1. A memory entry contai ...[truncated 1126 chars]- Remediation
View remediation