T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/evidence_pipeline/cache.py:22- Finding
Symlink-Based Access to Files Outside the Product Directory
- Content
View full analysis
list[Path]: product_dir = Path(product_dir).resolve() return sorted( path for path in product_dir.rglob("*") if path.is_file() and CACHE_DIRNAME not in path.relative_to(product_dir).parts and path.name not in {".DS_Store", "Thumbs.db"} ) ``` The accepted files are subsequently opened and hashed: ```python def sha256_file(path: Path, chunk_size: int = 1024 * 1024) -> str: digest = hashlib.sha256() with Path(path).open("rb") as handle: for chunk in iter(lambda: handle.read(chunk_size), b""): digest.update(chunk) return digest.hexdigest() ``` Supported text files are also read into the evidence pipeline: ```python if suffix in {".txt", ".md", ".csv"}: text_by_relative[relative] = path.read_text( encoding="utf-8", errors="replace" ) ``` ### Technical Analysis The containment check is performed against the lexical path returned by `Path.rglob()`. However, `is_file()`, `open()`, and `read_text()` follow symbolic links by default. The code does not resolve each candidate file and verify that the resolved target remains beneath the resolved product directory. Consequently, a symbolic link located inside the supplied product directory can point to any file readable by the process account. The expression below only proves that the symlink itself appears inside the directory; it does not prove that its target is inside the directory: ```python path.relative_to(product_dir) ``` The external target can be hashed, inventoried, and read into the evidence cache. If its content matches recognized ...[truncated 1370 chars]- Remediation
View remediation