T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/scanner.py:10- Finding
Workspace Scope Bypass Through Symbolic-Link Following
- Content
View full analysis
cutoff: recent_files.append(file_path) return sorted(recent_files, key=lambda x: x.stat().st_mtime, reverse=True) ``` The selected paths are subsequently opened without further validation: ```python full_text = "" for f in files: with open(f, 'r', encoding='utf-8') as file: content = file.read() clean = analyzer.clean_content(content) full_text += f"\n--- File: {f.name} ---\n{clean}\n" ``` ### Technical Analysis The scanner selects entries whose names match `*.md`, but it does not reject symbolic links or resolve each candidate and verify that the resolved path remains under the intended `memory` directory. Both `Path.stat()` and `open()` follow symbolic links by default. Consequently, an attacker who can create an entry in the scanned memory directory can point a Markdown filename to any file readable by the process. The destination does not need to reside in the OpenClaw workspace. Its contents will be read, processed by incomplete regex-based redaction, and submitted to the configured external LLM provider. The fallback to `./memory` also makes the effective scan location dependent on the current working directory when the configured directory does not exist. ### Attack Path 1. The attacker obtains write access to the configured ...[truncated 1013 chars]- Remediation
View remediation
cutoff: recent_files.append(resolved) ``` For stronger protection, open the validated file using operating-system flags equivalent to `O_NOFOLLOW`, then validate the opened file descriptor before reading. ]]>