T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/audit.sh:28
- Finding
- Recursive Memory Scan Exposes Sensitive Content in JSON Reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/audit.sh`, lines 28–35 and 57 **Vulnerability Type**: Sensitive local data exposure through overbroad scanning and unredacted output **Risk Level**: Medium ### Vulnerable Code ```bash # Prompt-injection pattern scan PI_PATTERNS='(ignore (all|previous) instructions|system prompt|developer message|tool call|jailbreak|do not follow|exfiltrate|leak|override|bypass|prompt injection|function call|tool output|BEGIN PROMPT|END PROMPT)' PI_SCAN_FILE="$TMPDIR/pi_scan.txt" # scan memory + workspace text files (safe, local) SCAN_PATHS=("$WORKDIR/memory" "$WORKDIR/skills" ) >"$PI_SCAN_FILE" for p in "${SCAN_PATHS[@]}"; do if [ -e "$p" ]; then grep -RInE --exclude-dir='.git' --exclude='*.png' --exclude='*.jpg' --exclude='*.jpeg' --exclude='*.gif' --exclude='*.webp' \ "$PI_PATTERNS" "$p" >>"$PI_SCAN_FILE" 2>/dev/null || true fi done ``` ```python "prompt_injection_hits": [l for l in read_file(os.environ["PI_SCAN_FILE"]).splitlines() if l.strip()], ``` ### Technical Analysis The script recursively searches the invoking user's OpenClaw memory and skill directories. Every matching line is copied into a temporary file and then included verbatim in the JSON report. A matching line may contain substantially more information than the detected keyword. For example, a line containing the phrase `system prompt` could also contain private conversation text, credentials, API tokens, internal instructions, filesystem paths, or personal information. The implementation performs no secret detection, redaction, output minimization, file-size restriction, or report-access control. The scan runs with the permissions of the user invoking the script. It does not independently gain elevated operating-system privileges, but it can read all matching files accessible to that account under the selected directories. Because the documented usage redirects stdout to a report file, exposed content can persist after the tem ...[truncated 1616 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable memory scanning by default and require explicit user consent for each scan root. 2. Apply least privilege by running the audit under a dedicated account that cannot read unrelated user data or credentials. 3. Return only minimal findings, such as: - Rule identifier - Relative filename - Line number - Redacted or hashed evidence 4. Never include complete matching lines unless an authorized user explicitly enables a diagnostic mode. 5. Add secret-redaction rules for tokens, private keys, passwords, authorization headers, and common credential formats before serialization. 6. Canonicalize and validate scan paths, and enforce an allowlist of approved roots. 7. Exclude symlinks or verify resolved paths so files outside approved roots cannot be scanned indirectly. 8. Restrict file types and maximum file sizes to prevent unnecessary data collection and resource exhaustion. 9. Create reports with restrictive permissions, such as mode `0600`, and define a secure retention policy. 10. Treat report content as untrusted data if it is later supplied to an AI agent or alert-rendering system. ]]>