T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- index.js:307
- Finding
- Unrestricted Cross-Agent Memory Access and Modification## Vulnerability Details **File Location**: `index.js:307-346`, `index.js:386-423` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```javascript async function scanAllAgentsWorkspaces() { const agentsDir = '/root/.openclaw/agents'; const activeAgents = []; try { if (!fsSync.existsSync(agentsDir)) { return activeAgents; } const agentEntries = await fs.readdir(agentsDir, { withFileTypes: true }); for (const entry of agentEntries) { if (entry.isDirectory()) { const agentId = entry.name; const workspacePath = `/root/.openclaw/workspace-${agentId}`; const memoryDir = path.join(workspacePath, 'memory'); if (!fsSync.existsSync(workspacePath)) { continue; } if (!fsSync.existsSync(memoryDir)) { continue; } let hasRecentWork = false; try { const memoryFiles = await fs.readdir(memoryDir); for (const file of memoryFiles) { if (file.endsWith('.md')) { const filePath = path.join(memoryDir, file); if (isFileModifiedWithinHours(filePath, 24)) { hasRecentWork = true; break; } } } } catch (error) { } if (hasRecentWork) { activeAgents.push({ id: agentId, workspace: workspacePath, memoryDir: memoryDir }); } } } } catch (error) { console.error('Error scanning agent workspaces:', error); } return activeAgents; } ``` ```javascript for (const file of files) { const originalTokens = file.tokens; const content = await fs.readFile(file.path, 'utf-8'); if (file.lines > preferences.compressionThreshold) { const newContent = summar ...[truncated 2200 chars]
- Remediation
- ## Remediation Suggestions - Restrict the default operating scope to the caller's current workspace. - Require an explicit, authenticated authorization decision for each additional agent. - Maintain a configurable allowlist of permitted agent identifiers and workspace roots. - Resolve paths with `path.resolve()` and verify that every target remains beneath an approved canonical root. - Reject symbolic links and unexpected filesystem object types before reading or writing. - Separate read-only statistics permissions from file-modification permissions. - Require explicit confirmation that identifies every affected agent and file before cross-agent writes. - Run the Skill under a dedicated, least-privileged operating-system account rather than relying on access to root-owned global directories. - Record an audit event for every cross-agent read and write.