T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:136- Finding
Namespace Restrictions and Prefix Filtering Can Be Bypassed
- Content
View full analysis
l.trim()); return lines; } catch (err) { if (err.message.includes('404')) { return []; // No memories found } throw err; } } ``` ### Technical Analysis The coordinate expansion function accepts a fully numeric 11-dimensional coordinate without applying the configured namespace. Consequently, namespace restrictions are not enforced for coordinates matching that format. The `list_memories` function also calculates `fullPrefix` and `encoded`, but never includes either value in the request or filters the response locally. It instead retrieves and returns the complete table of contents for the configured `phext`. These behaviors conflict with the documented claim that namespaces isolate agents. A namespace is being used as a naming convention rather than as an enforced authorization boundary. The risk is especially significant when multiple agents or users share the same backend storage scope or explicitly configure the same `phext`. ### Attack Path 1. Multiple agents are configured to use the same SQ endpoint and storage `phext`. 2. An untrusted agent or user invokes `list_memories("user/")`. 3. The function ignores the requested prefix and requests the complete table of contents. 4. Coordinates belonging to other workflows or agents wi ...[truncated 957 chars]- Remediation
View remediation