T05 · Unauthorized Access and Privilege Escalation
Error
- Location
main.py:213- Finding
Unrestricted Local File Access and Network Upload
- Content
View full analysis
Dict[str, Any]: """Upload file(s) to file input.""" await page.set_input_files(selector, files) return {"status": "success", "action": "upload_file", "selector": selector, "files": files} ``` ### Technical Analysis The `files` argument is controlled by the action caller and is passed directly to Playwright's `set_input_files`. The implementation does not normalize paths, restrict access to an approved upload directory, reject symbolic links, deny access to sensitive locations, or require confirmation before reading and uploading a file. Playwright reads each specified local file and transfers its contents through the Browserless session to the active website. While user-selected file upload is part of the declared browser automation functionality, granting access to every file readable by the Skill process exceeds the minimum privilege required. The response also returns the supplied local paths, potentially disclosing filesystem layout through Agent transcripts or logs. ### Attack Path 1. An attacker controls or influences the arguments supplied to the `upload_file` action. 2. The browser is directed to an attacker-controlled website containing a file input. 3. The attacker supplies a sensitive path, such as an environment file, private key, cloud credentials file, Agent configuration, or source file. 4. `set_input_files` reads the file using the privileges of the local Skill process. 5. The browser uploads the file through the Browserless session. 6. The attacker retrieves the file from the destination server. ### Impact Assessment Successful exploitation allows unauthorized reading and network exfiltration of any file accessible to the Skill process. Depending on deployment p ...[truncated 346 chars]- Remediation
View remediation