T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/discord-push.js:123- Finding
Arbitrary Local File Disclosure Through Discord Push Instructions
- Content
View full analysis
({ index: i + 1, total: chunks.length, content: c })), total_chunks: chunks.length, generated_at: new Date().toISOString() }; ``` ### Technical Analysis The `--report` argument is treated as an unrestricted filesystem path. The script only checks whether the path exists and then reads it with the privileges of the Node.js process. It does not require the target to be beneath `data/reports`, verify that it is a regular Markdown report, reject symbolic links, or enforce an approved filename pattern. The complete file contents are split into chunks and embedded in an Agent-consumable `discord_push` instruction. Although this script does not directly connect to Discord, its declared integration model expects another Agent component to execute the generated instruction. Therefore, the unrestricted local read can become an external data-disclosure channel. ### Attack Path 1. An attacker or untrusted workflow invokes the script with a sensitive readable path: ```bash node scripts/discord-pu ...[truncated 982 chars]- Remediation
View remediation