T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/check_permissions.py:18- Finding
Symlink Traversal Allows Permission Changes Outside the Requested Audit Root
- Content
View full analysis
List[Tuple[Path, int, int, str]]: """Check permissions and return list of issues.""" issues = [] if not path.exists(): return issues if path.is_dir(): current = get_permissions(path) if current > expected_dir: issues.append((path, current, expected_dir, "directory")) # Recursively check contents for item in path.iterdir(): issues.extend(check_permissions(item, expected_dir, expected_file)) else: current = get_permissions(path) if current > expected_file: issues.append((path, current, expected_file, "file")) return issues def fix_permissions(path: Path, expected_dir: int = 0o700, expected_file: int = 0o600) -> int: """Fix permissions for a path. Returns count of fixed items.""" issues = check_permissions(path, expected_dir, expected_file) fixed = 0 for item_path, current, expected, item_type in issues: try: os.chmod(item_path, expected) print(f"✓ Fixed {item_type}: {item_path} ({oct(current)} → {oct(expected)})") fixed += 1 except PermissionError as e: print(f"✗ Failed to fix {item_path}: {e}") return fixed ``` ### Technical Analysis The recursive permission checker does not reject symbolic links or enforce that resolved paths remain under the user-supplied audit root. `Path.is_dir()`, `Path.stat()`, directory traversal, and `os.chmod()` normally follow symbolic links. Consequently, a symbolic link placed inside the selected directory can redirect the audit to a file or directory outside that tree. If `--fix` is ena ...[truncated 1650 chars]- Remediation
View remediation