T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- security.md:16
- Finding
- Unrestricted Filesystem-Wide Credential File Reconnaissance## Vulnerability Details **File Location**: `security.md:16` **Vulnerability Type**: Excessive filesystem access and sensitive-file discovery **Risk Level**: Medium ### Vulnerable Code ```sh find / -name '.env' -o -name '*.pem' -o -name 'id_*' 2>/dev/null ``` The surrounding instruction describes this as a search “under the web roots,” but the command starts at the filesystem root (`/`). ### Technical Analysis Starting `find` at `/` traverses every readable filesystem and mount rather than only the service's document roots. The filename patterns specifically target files likely to contain credentials or cryptographic material: - `.env` files may contain passwords, API tokens, and connection strings. - `*.pem` files may contain private keys or certificates. - `id_*` commonly matches SSH private and public keys. The command does not read file contents or escalate privileges, but it can disclose the locations of unrelated users' and services' sensitive files. Redirecting standard error to `/dev/null` suppresses permission failures and makes the excessive traversal less apparent. This exceeds the minimum access needed to determine whether secrets are exposed through a particular web root. The search should be constrained to confirmed document roots and release directories belonging to the service under review. ### Attack Path 1. A user requests a service-hardening or exposure review. 2. The Agent follows the exposure-sweep instructions in `security.md`. 3. The Agent executes the provided `find / ...` command with the permissions available to the current account. 4. The command traverses all readable system locations and mounted filesystems. 5. Paths to unrelated environment files, PEM material, and SSH-key files are returned. 6. Those sensitive paths may enter the Agent context, terminal history, audit logs, or subsequent troubleshooting workflows. 7. A later unsafe action or compromised workflow could use this reconnaissance to target credential material ...[truncated 819 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `/` with the service's explicitly confirmed web root or document root: ```sh find /srv/api/current/public -xdev \ \( -name '.env' -o -name '*.pem' -o -name 'id_*' \) -print ``` 2. If multiple web roots exist, enumerate each approved path explicitly rather than searching the entire host. 3. Use `-xdev` to prevent traversal into unrelated mounted filesystems. 4. Obtain explicit user confirmation before expanding the search beyond known service directories. 5. Avoid searching user home directories, `/etc`, secret-manager mounts, backup locations, and other applications' directories unless they are specifically in scope. 6. Treat discovered paths as sensitive operational metadata. Do not persist them in Skill memory, artifacts, reports, or shared inventory unless strictly necessary. 7. Update the instruction text so the described scope and executed command match exactly.