T07 · Tool Hijacking and Spoofing
Warning
- Location
engine/generator.py:505- Finding
Unauthenticated File-Based LLM Session Allows Prompt Disclosure and Response Spoofing
- Content
View full analysis
str: try: uid = str(int(time.time() * 1000)) req_dir = self._SESSION_DIR os.makedirs(req_dir, exist_ok=True) req_path = os.path.join(req_dir, f"request_{uid}.json") resp_path = os.path.join(req_dir, f"response_{uid}.json") req = { "system": system, "user": user, "temperature": temperature, "timestamp": uid, } with open(req_path, "w", encoding="utf-8") as f: json.dump(req, f, ensure_ascii=False, indent=2) deadline = time.time() + 300 while time.time() < deadline: if os.path.exists(resp_path): try: with open(resp_path, "r", encoding="utf-8") as f: resp = json.load(f) text = resp.get("text", "") if text and len(text) > 50: os.remove(req_path) os.remove(resp_path) return text except (json.JSONDecodeError, OSError): pass time.sleep(0.5) logger.error(f"SessionProvider: timeout waiting for {uid}") return "" ``` ### Technical Analysis The session transport writes complete system prompts and user content to a shared relative directory named `_llm_session`. The filenames are derived solely from the current time in milliseconds and are therefore predictable. The implementation does not: - Create the session directory with explicit owner-only permissions. - Create request files atomically with restrictive permissions. - Use cryptographical ...[truncated 2341 chars]- Remediation
View remediation