T05 · Unauthorized Access and Privilege Escalation
- Location
references/logging.md:11- Finding
Unrestricted Workspace-Wide Discovery and Reading of Markdown Documents
- Content
View full analysis
Vulnerability Details
File Location:
references/logging.md:11-15; related requirements also appear inSKILL.md:24andSKILL.md:41
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: MediumVulnerable Instruction
markdown 1. Read the log baseline: read the root-level `learning-log.jsonl` and obtain the `date` and `courses` from its final record. 2. Scan all course folders: list every subdirectory under the root, excluding hidden directories and `.templates`. For each directory: - List all `XX.md` files, excluding `syllabus.md` and `summary.md`. - Compare them with the baseline to identify documents added since the last record. - Read the new documents and extract three to five core concepts or knowledge points.Related global access requirements direct the agent to read the root-level learning log at the beginning of every interaction and to read all Markdown files associated with a selected course.
Technical Analysis
The logging workflow assumes that every visible subdirectory beneath the workspace root is a course directory. It then enumerates files matching the broad
XX.mdnaming convention and reads their contents without requiring:- An explicit registry or allowlist of approved course directories.
- A trusted marker identifying a directory as managed by this Skill.
- User confirmation before indexing a previously unknown directory.
- Verification that resolved paths remain inside an approved course boundary.
- A check that the files are relevant to the current tutoring request.
A hidden-directory exclusion is not an adequate authorization boundary. An unrelated project or private directory can be visible and contain files such as
01.md, causing those files to be treated as learning material.Reading this content places it in the agent's context. The workflow can then extract information from it and persist a summary in ...[truncated 2084 chars]
- Remediation
View remediation
Remediation Suggestions
-
Introduce an explicit course registry
- Maintain a list of directories created by or explicitly approved for Bloom Tutor.
- Scan only directories present in that registry.
-
Require a trusted course marker
- Add a marker such as
.bloom-coursewhen creating a course. - Ignore directories without that marker, even if they contain files named
01.mdorsyllabus.md.
- Add a marker such as
-
Obtain consent before first-time indexing
- Present newly discovered candidate directories to the user.
- Read their contents only after explicit approval.
-
Enforce path boundaries
- Resolve canonical paths before accessing files.
- Verify that each resolved path is a descendant of an approved course directory.
- Reject symbolic links or traversal paths that escape that directory.
-
Apply request-scoped access
- Read only the active course for ordinary tutoring operations.
- Perform global indexing solely when the user explicitly requests global learning-log maintenance.
-
Reduce global-log exposure
- Do not read
learning-log.jsonlat the start of interactions that do not require historical state. - Store only the minimum metadata necessary for progress tracking.
- Avoid persisting sensitive excerpts or concepts from unapproved documents.
- Do not read
-
Treat discovered Markdown as untrusted data
- Ensure document contents cannot override Skill or system instructions.
- Extract learning content using a constrained parsing process rather than following instructions found inside documents.
-