T07 · Tool Hijacking and Spoofing
Error
- Location
lib/thread.js:100- Finding
Cross-Agent Message Disclosure and Sender Spoofing
- Content
View full analysis
{ if (msg.to === agentId || this.matchesFilter(msg, filter)) { handler(msg, permission); } }; this.on('message:send', listener); // 返回取消订阅函数 return () => { this.subscriptions.delete(subscription.id); this.off('message:send', listener); }; } ``` ### Technical Analysis The communication boundary uses agent IDs as both identifiers and authorization credentials, but it does not establish that the caller owns the identity it supplies. The `send()` method authorizes communication using the caller-controlled `message.from` and `message.to` fields. Although `Knot.canCommunicate()` checks whether those registered identities are permitted to communicate, it does not authenticate the component invoking `send()`. Code with access to the shared `Thread` instance can therefore place another registered agent's ID in `message.from` and impersonate that agent. The `subscribe()` method similarly accepts an arbitrary `agentId` without verifying that the subscriber owns or represents that agent. More importantly ...[truncated 2320 chars]- Remediation
View remediation
{ if (msg.to === agentId && this.matchesFilter(msg, filter)) { handler(msg, permission); } }; ``` 5. Define empty-filter behavior explicitly. If an empty filter should accept all messages addressed to the authenticated recipient, use: ```javascript const filterMatches = !filter || this.matchesFilter(msg, filter); if (msg.to === agentId && filterMatches) { handler(msg, permission); } ``` 6. Avoid a globally observable EventEmitter channel for confidential traffic. Use per-agent queues or private channels keyed to authenticated agent contexts. 7. Authenticate RPC responses by validating the responder, intended recipient, correlation ID, and expected communication relationship—not only the correlation ID. 8. Add security tests proving that: - A subscriber cannot receive messages addressed to another agent. - A broad filter cannot bypass recipient restrictions. - An unregistered caller cannot subscribe. - A caller cannot forge another agent's `from` identity. - RPC responses from unexpected agents are rejected. ]]>