T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:22- Finding
Workspace-Wide Image Enumeration and Unverified File Selection
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22–37, 77–84, and 90–91
Vulnerability Type: Missing authorization boundary and unsafe resource-selection logic
Risk Level: MediumVulnerable Instructions
SKILL.md, lines 22–37:text ### Step 1：查找图片的真实路径 使用 `images_list` 工具，遍历找到对应的图片文件：images_list(start=0, number=20)
text 在返回结果中找到图片的 `Path` 字段，如：/workspace/user_input_files/image.png /workspace/imgs/xxx.jpg
text **匹配逻辑：** - 如果文件名包含用户消息中的关键词（如用户说"这张图"），匹配 - 如果有多张最新图片，取最新的（按修改时间） - 如果是唯一的 user_input_files/image.png，直接使用SKILL.md, lines 77–84:text 当收到用户图片消息时： 1. 从消息元数据提取文件名（如 image.png） 2. 调用 images_list(start=0, number=20) 3. 在结果中搜索包含该文件名的记录 4. 找到 → 提取 Path 字段（真实绝对路径） 5. 调用 images_understand(file=真实路径, prompt=用户问题) 6. 回答用户SKILL.md, lines 90–91:text - 不能假设消息中的文件名可以直接访问 - images_list 能看到 /workspace 下所有图片的真实路径Technical Analysis
The Skill instructs the agent to enumerate images visible throughout
/workspaceand then select a file using filename, uniqueness, or modification-time heuristics. It does not require a trusted attachment identifier, validate that the selected image belongs to the current user or conversation, or restrict discovery to a conversation-specific upload directory.Filename similarity and file recency are not authorization controls. Generic names such as
image.pngcan occur in multiple sessions, while selecting the most recently modified image may choose a file uploaded by another user. The selected absolute path is subsequently passed toimages_understand, and the resulting contents may be disclosed in the response.This violates least privilege because analyzing one message attachment does not legitimately require visibility into unrelated images throughout the workspace.
Attack Path
- A victim or another session places a sensitive image in a location v ...[truncated 1398 chars]
- Remediation
View remediation
Remediation Suggestions
- Use an authenticated attachment identifier supplied by the current message or platform API rather than discovering files by workspace-wide enumeration.
- Resolve attachment identifiers server-side and verify that the resolved file belongs to the current user, conversation, and message before analysis.
- Restrict file lookup to a per-conversation or per-request upload directory. Do not allow the Skill to enumerate all images under
/workspace. - Require exact identifier matching. Do not use filename substrings, uniqueness, or modification time as authorization or ownership evidence.
- Fail closed when attachment resolution is missing or ambiguous. Ask the user to upload the image again rather than selecting the newest candidate.
- Pass only validated, canonicalized paths to
images_understand, and enforce an allowlisted upload root after resolving symbolic links and path normalization. - Minimize metadata returned by image-listing tools so unrelated filenames and absolute paths are not exposed to the agent.
- Add tests covering duplicate filenames, simultaneous uploads, multiple users, stale images, symbolic links, and attempts to reference files from another conversation.