T05 · Unauthorized Access and Privilege Escalation
Error
- Location
generate.js:37- Finding
Cross-User Disclosure Through Global Feishu Session Selection
- Content
View full analysis
latestTime) { latestTime = session.updatedAt; latestFeishuSession = session; } } } if (!latestFeishuSession || !latestFeishuSession.sessionFile) { console.log('⚠️ No Feishu session found; skipping session history'); return ''; } const sessionFile = latestFeishuSession.sessionFile; if (!fs.existsSync(sessionFile)) { console.log('⚠️ Session file does not exist:', sessionFile); return ''; } // Read the JSONL file const lines = fs.readFileSync(sessionFile, 'utf-8').split('\n'); const messages = []; const today = new Date(); const todayStr = today.toISOString().split('T')[0]; lines.forEach(line => { if (!line.trim()) return; try { const entry = JSON.parse(line); if (entry.type === 'message' && entry.message) { const timestamp = new Date(entry.timestamp).toISOString().split('T')[0]; if (timestamp >= todayStr) { messages.push({ role: entry.message.role, content: entry.message.content?.[0]?.text || '' }); } } } catch (e) { // Skip lines that cannot be parsed } }); ``` ### Technical Analysis The report generator does not bind session selection to an explicitly authorized Feishu user, conversation identifier, or report recipient. Instead, it iterates over every entry whose key contai ...[truncated 1706 chars]- Remediation
View remediation