T01 · Skill Instruction Hijacking
Error
- Location
scripts/trace_debugger_safety.py:273- Finding
Untrusted Elasticsearch Logs Are Passed to Codex Without Effective Isolation
- Content
View full analysis
\n" "2) 证据：<...>\n" "3) 解决方案：<...>\n\n" "日志如下（JSON Lines）：\n" + payload ) try: p = subprocess.run( ["codex", "exec", prompt], cwd=repo_path, capture_output=True, text=True, timeout=240, ) ``` ### Technical Analysis Elasticsearch records are serialized directly into a natural-language prompt and supplied to `codex exec`. The implementation limits the number of records to 200, but it does not impose a total byte limit, sanitize instruction-like text, remove sensitive fields, or structurally isolate log data from executable instructions. The normalized records also retain the complete Elasticsearch `_source` object in the `raw` field. Consequently, fields beyond those needed for trace analysis may be included in the Codex prompt. An attacker who can cause crafted messages to be indexed under a target trace ID can insert instructions that attempt to override the analysis task, request repository inspection, suppress findings, or induce disclosure of source-code information. Codex is also launched with the repository as its working directory, increasing the potential scope of agent actions. ### Attack Path 1. An attacker causes an application to emit a log associated with a trace ID that a user will investigate. 2. The crafted log contains instruction-like content designed to manipulate the Codex agent. 3. Elasticsearch returns the record in response to the trace query. 4. `normalize_es_logs()` preserves the record, including its complete `raw` source. 5. `run_codex_analysis()` serializ ...[truncated 1099 chars]- Remediation
View remediation