T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/utils/validator.js:12
- Finding
- Arbitrary Readable Local Files Can Be Uploaded to Remote Storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/validator.js:12-19`; `scripts/video2text/index.js:124-147` **Vulnerability Type**: Missing file-type and path-scope validation **Risk Level**: High ### Vulnerable Code ```js // scripts/utils/validator.js:12-19 function isFilePath(path) { try { const stats = fs.statSync(path); return stats.isFile(); } catch (_) { return false; } } ``` ```js // scripts/video2text/index.js:124-147 } else if (!validator.isFilePath(file)) { utils.printError("无效的文件路径或URL"); process.exit(1); } if (!fs.existsSync(file)) { utils.printError("文件不存在: " + file); process.exit(1); } try { const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { throw new Error("获取预签名URL失败，请反馈给开发者"); } utils.printInfo("上传文件到安全空间..."); await upload.uploadFileToOSS(file, presignedUrl.url, presignedUrl.headers); ``` ### Technical Analysis The `--file` parameter is documented as accepting video files, but validation only verifies that the supplied path resolves to a regular file. There is no validation of: - File extension or detected MIME type - Audio/video file signatures - Allowed source directories - Symbolic-link resolution - User confirmation for sensitive paths - Maximum file size Consequently, any file readable by the Node.js process can enter the upload workflow, including credentials, private keys, configuration files, source code, and customer documents. Because `fs.statSync()` follows symbolic links, a symbolic link to a sensitive regular file would also pass this check. Uploading a user-selected local video is necessary for the declared functionality, but unrestricted access to every readable local file exceeds the minimum privilege required for video transcription. ### Attack Path 1. An attacker supplies content or instructions that cause an AI agent to invoke the Skill with a sensitive path, such a ...[truncated 1074 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict local input to explicitly approved directories or paths selected directly by the user. 2. Resolve the canonical path with `fs.realpathSync()` and verify that it remains under an allowed root. 3. Use `fs.lstatSync()` to reject symbolic links before opening a file. 4. Validate both a strict extension allowlist and the actual file signature for supported audio/video formats. 5. Reject device files, pipes, sockets, and other special files. 6. Enforce a maximum input size before requesting upload authorization. 7. Require explicit confirmation when an agent attempts to upload a local file, displaying the canonical path and remote destination. 8. Run the Skill in a sandbox with filesystem access limited to user-provided media files. ]]>