T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- pipelinegate/executor.py:137
- Finding
- Unauthenticated Environment and Executable Reconnaissance## Vulnerability Details **File Location**: `pipelinegate/executor.py:137-149`; exposed through `pipelinegate/app.py:24-49` **Vulnerability Type**: Missing authorization for host environment discovery **Risk Level**: Medium ### Vulnerable Code ```python def exec_check_env(inp: dict) -> dict: req_env = inp.get("required_env", []) req_bins = inp.get("required_bins", []) present_env = [v for v in req_env if os.environ.get(v) is not None] missing_env = [v for v in req_env if os.environ.get(v) is None] present_bins = [b for b in req_bins if shutil.which(b) is not None] missing_bins = [b for b in req_bins if shutil.which(b) is None] return { "ready": len(missing_env) == 0 and len(missing_bins) == 0, "present_env": present_env, "missing_env": missing_env, "present_bins": present_bins, "missing_bins": missing_bins, } ``` The operation is exposed through an endpoint with no authentication or authorization: ```python @app.post("/v1/run", response_model=PipelineResponse) async def run_pipeline(request: PipelineRequest) -> PipelineResponse: """Execute a multi-step pipeline.""" results: list[StepResult] = [] completed = 0 overall_success = True for step in request.steps: success, output, error = execute_step(step.tool, step.input) results.append(StepResult( tool=step.tool, success=success, output=output, error=error, )) ``` ### Technical Analysis The `check-env` tool accepts arbitrary environment-variable and executable names from a request. It tests those names against the server's process environment and executable search path, then returns the results directly. The application does not apply authentication, authorization, an allowlist, or a trust-boundary check before invoking this functionality. Consequently, any client capable of reaching the ...[truncated 1461 chars]
- Remediation
- ## Remediation Suggestions 1. Require authenticated access to `/v1/run`, and authorize callers separately for tools that inspect server state. 2. Bind the service to the loopback interface by default unless remote access is explicitly required and protected. 3. Replace arbitrary client-supplied environment and binary names with a server-side allowlist. 4. Permit checks only for dependencies explicitly declared by the installed Skill or approved configuration. 5. Consider returning only a general readiness result rather than identifying every present environment variable and executable. 6. Apply request rate limits and audit repeated enumeration attempts. 7. Run the service with a minimal environment and restricted executable search path.