T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:307- Finding
Unrestricted Cross-Agent Memory Access and Modification
- Content
View full analysis
Vulnerability Details
File Location:
index.js:307-346,index.js:386-423
Vulnerability Type:T05: Unauthorized Access and Privilege Escalation
Risk Level: HighVulnerable Code
javascript async function scanAllAgentsWorkspaces() { const agentsDir = '/root/.openclaw/agents'; const activeAgents = []; try { if (!fsSync.existsSync(agentsDir)) { return activeAgents; } const agentEntries = await fs.readdir(agentsDir, { withFileTypes: true }); for (const entry of agentEntries) { if (entry.isDirectory()) { const agentId = entry.name; const workspacePath = `/root/.openclaw/workspace-${agentId}`; const memoryDir = path.join(workspacePath, 'memory'); if (!fsSync.existsSync(workspacePath)) { continue; } if (!fsSync.existsSync(memoryDir)) { continue; } let hasRecentWork = false; try { const memoryFiles = await fs.readdir(memoryDir); for (const file of memoryFiles) { if (file.endsWith('.md')) { const filePath = path.join(memoryDir, file); if (isFileModifiedWithinHours(filePath, 24)) { hasRecentWork = true; break; } } } } catch (error) { } if (hasRecentWork) { activeAgents.push({ id: agentId, workspace: workspacePath, memoryDir: memoryDir }); } } } } catch (error) { console.error('Error scanning agent workspaces:', error); } return activeAgents; }javascript for (const file of files) { const originalTokens = file.tokens; const content = await fs.readFile(file.path, 'utf-8'); if (file.lines > preferences.compressionThreshold) { const newContent = summar ...[truncated 2200 chars]- Remediation
View remediation
Remediation Suggestions
- Restrict the default operating scope to the caller's current workspace.
- Require an explicit, authenticated authorization decision for each additional agent.
- Maintain a configurable allowlist of permitted agent identifiers and workspace roots.
- Resolve paths with
path.resolve()and verify that every target remains beneath an approved canonical root. - Reject symbolic links and unexpected filesystem object types before reading or writing.
- Separate read-only statistics permissions from file-modification permissions.
- Require explicit confirmation that identifies every affected agent and file before cross-agent writes.
- Run the Skill under a dedicated, least-privileged operating-system account rather than relying on access to root-owned global directories.
- Record an audit event for every cross-agent read and write.