T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/utils/validator.js:11
- Finding
- Arbitrary Local Files Can Be Uploaded to the Remote Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/validator.js:11-18`, with the upload sink at `scripts/video2text/index.js:120-136` **Vulnerability Type**: Missing file-type and path-scope validation **Risk Level**: High ### Vulnerable Code ```js function isFilePath(path) { try { const stats = fs.statSync(path); return stats.isFile(); } catch (_) { return false; } } ``` The accepted file is subsequently uploaded without validating that it is video or audio content: ```js if (!fs.existsSync(file)) { utils.printError("文件不存在: " + file); process.exit(1); } try { const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { throw new Error("获取预签名URL失败，请反馈给开发者"); } utils.printInfo("上传文件到安全空间..."); await upload.uploadFileToOSS(file, presignedUrl.url, presignedUrl.headers); ``` ### Technical Analysis The local-file validator only verifies that the supplied path refers to a regular file. It does not enforce: - A supported video or audio extension - A recognized media MIME type - Media magic-byte validation - A permitted workspace or media-directory boundary - Exclusion of sensitive operating-system, credential, or configuration paths The upload implementation uses `fs.createReadStream()` to transmit the complete accepted file. Consequently, any readable regular file available to the process can be treated as video input and sent to the remote storage service. This violates least privilege for a skill whose declared purpose is processing video and audio media. It is particularly relevant when command arguments are generated from untrusted natural-language instructions. ### Attack Path 1. An attacker influences an instruction processed by the agent and supplies a sensitive local path through `--file`. 2. Examples could include an environment file, cloud credential file, SSH private key, or another readable application configuratio ...[truncated 1063 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Define an explicit allowlist of supported video and audio formats. 2. Validate both the filename extension and file magic bytes; do not rely exclusively on user-provided extensions or MIME types. 3. Resolve the supplied path with `fs.realpath()` and require it to remain inside an approved workspace or media directory. 4. Reject known sensitive locations, including home-directory credential stores, SSH directories, cloud configuration directories, environment files, and system configuration paths. 5. Use `lstat()` and reject symbolic links unless there is a specific requirement to support them. 6. Require explicit user confirmation before uploading files outside the current workspace. 7. Apply a maximum file-size limit before opening the upload stream. 8. Avoid sending the complete local path to the presign API; send only a sanitized basename when server-side naming requires it. ]]>