T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/websearch.sh:24- Finding
Overprivileged Codex Fallback Exposes the Host to Prompt-Driven Agent Actions
- Content
View full analysis
/dev/null; then BACKEND="claude" elif command -v codex &>/dev/null; then BACKEND="codex" else echo "Error: neither 'claude' nor 'codex' CLI found in PATH." >&2 exit 1 fi fi case "$BACKEND" in claude) claude -p "$PROMPT" --allowedTools "WebSearch" 2>/dev/null ;; codex) # Codex needs --skip-git-repo-check outside a git repo # Runs from /tmp to avoid workspace context loading delay TMPDIR_SEARCH=$(mktemp -d) cd "$TMPDIR_SEARCH" codex --search -c reasoning_effort=low exec --skip-git-repo-check "$PROMPT" 2>/dev/null ``` ### Technical Analysis The script directly embeds the user-controlled `QUERY` and `MAX_RESULTS` values into an instruction passed to a nested AI agent. The values are shell-quoted, so this is not conventional shell command injection. However, they remain untrusted natural-language instructions and can contain prompt-injection content intended to override the search task. The Claude backend explicitly limits tools with `--allowedTools "WebSearch"`. The Codex fallback does not establish an equivalent web-search-only tool allowlist or an explicit least-privilege sandbox. Running Codex from a newly created temporary directory reduces accidental workspace context loading, but it does not by itself guarantee that the process cannot access other host paths, execute tools, or perform operations allowed by the local Codex configuration. Consequently, a malicious query may persuade the nested Codex agent to perform actions beyond web search. The actual exp ...[truncated 1620 chars]- Remediation
View remediation