T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- review-work.sh:117
- Finding
- Unrestricted model-assisted file access can expose data outside the review scope<![CDATA[ ## Vulnerability Details **File Location**: `review-work.sh:117-121, 137-155` **Vulnerability Type**: Excessive filesystem permissions and insufficient isolation **Risk Level**: High ### Vulnerable Code ```bash SYSTEM_PROMPT="You are a code and content reviewer. You can ONLY read files — never edit, write, or execute anything. ## How to review 1. Read ALL files at the given path. If it's a folder, read every file in it (skip node_modules, .git, __pycache__, dist, build, .next, vendor, venv, .cache directories). For images, view them. For PDFs, read them. ``` ```bash # User prompt: task-specific info USER_PROMPT="Review the work at \`$CONTEXT_PATH\`. **Original task:** ${TASK}" if [ -n "$SKILL_PATH" ] && [ -e "$SKILL_PATH" ]; then USER_PROMPT="${USER_PROMPT} **Skill definition:** \`$SKILL_PATH\` — read this and verify the work meets every requirement." fi if [ -f "$LESSONS_FILE" ]; then USER_PROMPT="${USER_PROMPT} **Past mistakes:** \`$LESSONS_FILE\` — read this and check for repeat mistakes." fi ``` The resulting prompt is executed at `review-work.sh:159-165`: ```bash REVIEW_OUTPUT=$(claude --print \ --model sonnet \ --dangerously-skip-permissions \ --tools "Read,Glob,Grep" \ --no-session-persistence \ --append-system-prompt "$SYSTEM_PROMPT" \ "$USER_PROMPT" 2>"$STDERR_LOG") ``` ### Technical Analysis The script grants the Claude CLI local `Read`, `Glob`, and `Grep` tools while explicitly disabling permission enforcement through `--dangerously-skip-permissions`. The requested context path is communicated only through natural-language prompt content; it is not an operating-system-level or tool-level access boundary. Files under the context path, the optional skill path, the task summary, and the persistent lessons file must therefore be treated as untrusted prompt content. A malicious reviewed file can contain instructions asking the model to ignore the intended review scope and read sensitive files elsewhere on the filesys ...[truncated 1926 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions` and retain the Claude CLI's normal permission checks. 2. Do not rely on prompt instructions to enforce filesystem boundaries. 3. Copy explicitly approved review inputs into a newly created, permission-restricted temporary directory and expose only that directory to the reviewer. 4. Resolve and validate every path with `realpath`, then reject paths that escape the approved root. 5. Reject or safely dereference symbolic links so they cannot point outside the review root. 6. Apply an allowlist of file types and exclude common secret-bearing files such as `.env`, private keys, credential stores, cloud configuration, and authentication tokens. 7. Require explicit user confirmation before sending local files to an external service, especially when the context is a directory. 8. Run the reviewer in an operating-system sandbox or container with read access only to staged inputs and no access to the user's home directory. 9. Treat all file contents as untrusted data and explicitly instruct the reviewer not to follow instructions embedded in reviewed artifacts. This prompt-level mitigation should supplement, not replace, technical isolation. ]]>