T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/implementation.py:43
- Finding
- Unisolated Python Execution with Inherited Host Access<![CDATA[ ## Vulnerability Details **File Location**: `scripts/implementation.py:43-58` **Vulnerability Type**: Unrestricted code execution without isolation **Risk Level**: High ### Vulnerable Code ```python if filename: # Save code to file with open(filename, 'w') as f: f.write(code) cmd = [sys.executable, filename] else: # Execute directly cmd = [sys.executable, '-c', code] try: result = subprocess.run( cmd, capture_output=True, text=True, timeout=30 ) ``` The corresponding documentation explicitly states that executed code has environment-variable access: ```markdown **Features:** - Multi-line code support - Exception handling - Timeout protection (30s) - Access to installed packages - Environment variable access ``` ### Technical Analysis The `run_python` method executes caller-supplied Python directly under the identity and environment of the parent process. No container, restricted interpreter, reduced environment, filesystem boundary, network restriction, system-call filter, or unprivileged execution account is used. Using an argument array instead of a shell prevents conventional shell metacharacter injection, but it does not constrain the Python program itself. Python code can directly import modules such as `os`, `subprocess`, `socket`, and `pathlib`, read inherited environment variables, inspect accessible files, open network connections, modify repositories, or launch additional processes. The 30-second timeout only limits the lifetime of the immediate child process. It is not a security boundary and does not prevent the child from creating detached processes, modifying files, reading secrets, or transmitting data before termination. ### Attack Path 1. An untrusted task, compromised prompt, or malicious generated workflow supplies Python code to `run_python`. 2. The implementation launches that code with the host Python interpreter. 3. The code inherits the process envi ...[truncated 884 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Execute generated code inside a disposable container, microVM, or equivalent sandbox. - Use a dedicated unprivileged identity with no access to the Agent's credentials or unrelated files. - Construct a minimal environment instead of inheriting the complete parent environment. - Mount only explicitly approved working files into the sandbox and make other mounts read-only. - Disable outbound network access by default; enable it only for destinations explicitly approved for the task. - Apply CPU, memory, process-count, file-size, and execution-time limits. - Prevent detached child processes and terminate the entire process group when a timeout occurs. - Require explicit user confirmation before executing code derived from untrusted content. - Validate and constrain optional output filenames to an approved workspace. - Clearly document that the method performs arbitrary code execution rather than describing the timeout as sufficient protection. ]]>