T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- main.py:213
- Finding
- Unrestricted Local File Access and Network Upload<![CDATA[ ## Vulnerability Details **File Location**: `main.py:213-216` **Vulnerability Type**: Unrestricted file upload from local filesystem **Risk Level**: High ### Vulnerable Code ```python async def upload_file(page: Page, selector: str, files: List[str]) -> Dict[str, Any]: """Upload file(s) to file input.""" await page.set_input_files(selector, files) return {"status": "success", "action": "upload_file", "selector": selector, "files": files} ``` ### Technical Analysis The `files` argument is controlled by the action caller and is passed directly to Playwright's `set_input_files`. The implementation does not normalize paths, restrict access to an approved upload directory, reject symbolic links, deny access to sensitive locations, or require confirmation before reading and uploading a file. Playwright reads each specified local file and transfers its contents through the Browserless session to the active website. While user-selected file upload is part of the declared browser automation functionality, granting access to every file readable by the Skill process exceeds the minimum privilege required. The response also returns the supplied local paths, potentially disclosing filesystem layout through Agent transcripts or logs. ### Attack Path 1. An attacker controls or influences the arguments supplied to the `upload_file` action. 2. The browser is directed to an attacker-controlled website containing a file input. 3. The attacker supplies a sensitive path, such as an environment file, private key, cloud credentials file, Agent configuration, or source file. 4. `set_input_files` reads the file using the privileges of the local Skill process. 5. The browser uploads the file through the Browserless session. 6. The attacker retrieves the file from the destination server. ### Impact Assessment Successful exploitation allows unauthorized reading and network exfiltration of any file accessible to the Skill process. Depending on deployment p ...[truncated 346 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict uploads to a dedicated, explicitly configured upload directory. 2. Resolve each path with `Path.resolve()` and verify that it remains inside the approved directory. 3. Reject absolute paths, traversal sequences, symbolic-link escapes, device files, sockets, and other non-regular files. 4. Maintain a denylist for sensitive filenames and directories, including `.env`, SSH keys, credential stores, Agent state, and cloud configuration. 5. Require explicit user confirmation that displays the resolved file paths before upload. 6. Apply file-size, file-count, and permitted-extension limits. 7. Avoid returning complete local paths in action responses. 8. Run the Skill under a dedicated account with minimal filesystem permissions. ]]>