T02 · Agent Memory Poisoning
Error
- Location
scripts/soul-server.js:27- Finding
Unauthenticated Network API Permits Persistent Agent Instruction Poisoning
- Content
View full analysis
body += chunk); req.on('end', () => { try { const data = JSON.parse(body); fs.writeFileSync(soulPath, data.content, 'utf-8'); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ ok: true, path: soulPath })); } catch (e) { res.writeHead(400, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: e.message })); } }); return; } ``` ```javascript server.listen(PORT, () => { console.log(`SOUL Editor server running at http://localhost:${PORT}`); console.log(`Agents directory: ${AGENTS_DIR}`); console.log('Press Ctrl+C to stop'); }); ``` ### Technical Analysis The HTTP server does ...[truncated 2613 chars]- Remediation
View remediation
{ console.log(`SOUL Editor server running at http://127.0.0.1:${PORT}`); }); ``` 2. Require authentication for every API endpoint. Generate a cryptographically random token and require it in an `Authorization` header. 3. Replace wildcard CORS with an explicit trusted origin. If the editor is served by the same server, disable CORS and use same-origin requests. 4. Implement authorization so that authenticated users can access only approved agent files. 5. Add CSRF protection if browser cookies or session authentication are used. 6. Require explicit confirmation for persistent instruction changes and retain backups or version history. 7. Validate saved content against an expected SOUL schema and reject unexpected instruction sections where appropriate. 8. Apply restrictive filesystem permissions to the agents directory and run the server under a dedicated, least-privileged account. 9. Add request logging and audit records for every read and modification operation. ]]>