T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/memory_integration.py:39
- Finding
- Agent Memory and Search Metadata Exposed to Unverified External Adapters<![CDATA[ ## Vulnerability Details **File Location**: `scripts/memory_integration.py:39-41, 91-118, 138-200, 242-256, 321-332` **Vulnerability Type**: Excessive access to sensitive Agent memory and delegation across an unverified trust boundary **Risk Level**: Medium ### Vulnerable Code ```python def __init__(self): self.workspace = Path(os.environ.get( 'OPENCLAW_WORKSPACE', '/root/.openclaw/workspace' )) self.memory_dir = self.workspace / 'memory' self.tracker = CoOccurrenceAdapter() ``` ```python def get_all_memory_files(self): files = [] memory_file = self.workspace / 'MEMORY.md' if memory_file.exists(): files.append(memory_file) if self.memory_dir.exists(): files.extend(sorted(self.memory_dir.glob('*.md'))) return files def parse_single_file(self, file_path): memories = [] print(f"Parsing {file_path}") with open(file_path, 'r', encoding='utf-8') as f: content = f.read() lines = content.split('\n') for i, line in enumerate(lines): if line.strip() and not line.startswith('#') and len(line.strip()) > 10: mem_id = self.generate_memory_id(str(file_path), line, i) memory = { 'id': mem_id, 'content': line.strip(), 'file': str(file_path), 'line': i, 'type': 'ltm' if file_path.name == 'MEMORY.md' else 'stm' } if file_path.name != 'MEMORY.md': memory['date'] = file_path.stem memories.append(memory) return memories ``` ```python if len(mem_ids) > 1: self.tracker.record_co_occurrence( mem_ids, f"search:{query[:50]}" ) ``` ```python def semantic_search(self, query: str, limit: int = 10) -> list: if self.vector_store is None: return [] try: results = self.vector_store.search(query, limit) ``` ### Tech ...[truncated 2830 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit authorization before the first memory synchronization or semantic search. 2. Introduce a configurable allowlist of permitted files and directories rather than automatically processing all memory files. 3. Default to a dedicated, non-sensitive integration directory instead of the entire native memory store. 4. Add a local-only mode that prevents data from reaching adapters backed by remote services. 5. Verify adapter provenance and expose whether each adapter performs local storage, remote storage, or network communication. 6. Do not send raw search queries unless necessary. Redact secrets and sensitive entities, or replace queries with local embeddings generated by a reviewed component. 7. Replace source paths in adapter records with opaque local identifiers. 8. Add retention limits, deletion support, access controls, and encryption for synchronized metadata. 9. Document the trust boundary and precisely disclose which memory-derived fields and query data are passed to each adapter. 10. Honor the documented feature-disable environment variables and fail closed when an adapter's security properties cannot be established. ]]>