T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/push_to_wecom_v4.sh:84- Finding
Overbroad Root-Level Termination of Browser Processes
- Content
View full analysis
/dev/null || true # 统计僵尸进程 local zombie_count=$(ps aux | grep 'chrome.*' | grep -v grep | wc -l) if [ "$zombie_count" -gt 0 ]; then log "WARN" "发现 $zombie_count 个僵尸 chrome 进程，将彻底清理" fi # 彻底清理所有 agent-browser 相关进程 local chrome_count=$(ps aux | grep -E 'agent-browser|chrome.*agent-browser' | grep -v grep | wc -l) if [ "$chrome_count" -gt 0 ]; then log "INFO" "发现 $chrome_count 个旧浏览器进程，强制清理..." pkill -9 -f 'agent-browser' 2>/dev/null || true sleep 1 pkill -9 -f 'chrome' 2>/dev/null || true sleep 2 fi } ``` The script also establishes a root-oriented execution environment: ```bash export PATH="/root/.nvm/versions/node/v22.22.1/bin:/root/.local/share/pnpm:/root/.local/bin:/usr/local/bin:/usr/bin:/bin:$PATH" export HOME="/root" ``` ### Technical Analysis The cleanup function does not restrict termination to the browser process or session created by the current script. In particular, `pkill -9 -f 'chrome'` matches every Chrome process visible to the executing account. The script sets `HOME` to `/root` and is designed for cron execution, so it may operate with root privileges. Although `AGENT_BROWSER_SESSION` is defined, the cleanup logic does not use that identifier to select processes. It instead relies on broad command-line substring matching and sends `SIGKILL`, preventing graceful shutdown or state recovery. This violates least-privilege and process-ownership boundaries. It can disrupt unrelated users, agents, browser automation tasks, monitoring jobs, or interactive browser se ...[truncated 1109 chars]- Remediation
View remediation