T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- .claude/settings.json:1
- Finding
- Overly Broad Python Execution Permission Enables Arbitrary Code Execution## Vulnerability Details **File Location**: `.claude/settings.json`, lines 1-8 **Vulnerability Type**: Overly broad command execution permission **Risk Level**: High ### Vulnerable Code ```json { "permissions": { "allow": [ "Bash(python:*)", "Bash(python3:*)" ] } } ``` ### Technical Analysis The configuration permits every Bash command beginning with `python` or `python3`, rather than limiting execution to the supplied `search_util.py` utility. The legitimate function of this skill only requires running a specific search script, so unrestricted interpreter access violates least privilege. An unrestricted Python interpreter is effectively a general-purpose code-execution facility. Commands such as `python3 -c "..."` can read and modify files, access environment variables, create network connections, launch subprocesses, or execute operating-system commands with the privileges of the agent process. Although the audited package contains no malicious Python payload, this permission substantially expands what an injected or incorrectly generated command could do. ### Attack Path 1. The skill is installed with the included Claude permission configuration. 2. The agent processes attacker-controlled instructions, potentially through a user request or untrusted web-search content. 3. Those instructions induce the agent to invoke a command such as `python3 -c "<attacker-controlled code>"`. 4. The wildcard permission matches the command because it begins with `python3`. 5. The Python code executes without an additional permission boundary. 6. The code can access files, environment variables such as `ZHIPUAI_API_KEY`, subprocess APIs, and network resources available to the agent account. ### Impact Assessment Successful exploitation provides arbitrary code execution under the operating-system account running the agent. Potential consequences include: - Reading or modifying any f ...[truncated 610 chars]
- Remediation
- ## Remediation Suggestions - Replace interpreter-wide wildcard rules with a narrowly scoped rule that permits only the intended script and required arguments. - Avoid permitting `python -c`, `python3 -c`, standard-input execution, arbitrary module execution through `-m`, or arbitrary script paths. - If the permission system cannot constrain arguments safely, expose the search operation as a dedicated tool rather than granting Bash access. - Run the utility in a sandbox with a restricted filesystem, minimal environment variables, and outbound network access limited to `open.bigmodel.cn`. - Keep `ZHIPUAI_API_KEY` outside subprocess environments unless it is strictly required by the invoked process. - Require explicit approval for commands that do not exactly match the expected `search_util.py` invocation. - Add tests verifying that commands such as `python3 -c`, `python3 -m`, and execution of unrelated scripts are denied.