T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- index.ts:31
- Finding
- Unrestricted Local File Disclosure Through AI Review<![CDATA[ ## Vulnerability Details **File Location**: `index.ts:31-42` **Vulnerability Type**: Arbitrary local file read and transmission to an LLM **Risk Level**: High ### Vulnerable Code ```ts } else if (action === "review") { if (!fs.existsSync(targetPath)) { throw new Error(`File not found: ${targetPath}`) } const code = fs.readFileSync(targetPath, "utf8") if (!ctx || !ctx.llm) { throw new Error("LLM context (ctx.llm) is required for semantic review.") } return aiReview(code, ctx.llm) ``` ### Technical Analysis The `path` input is controlled by the caller and is used directly with `fs.readFileSync`. The implementation does not: - Restrict the file to an approved project root. - Canonicalize the path before authorization. - Reject symbolic links. - Require a supported source-code extension. - Reject sensitive system or credential files. - Apply a maximum file-size limit. - Request confirmation before passing file contents to the LLM. Consequently, any file readable by the process can be selected for review. Its contents are then passed to `aiReview` and incorporated into an LLM request. Depending on the configured `ctx.llm`, this can move sensitive local data across a provider or trust boundary. ### Attack Path 1. An attacker obtains permission to invoke the Skill. 2. The attacker selects the `review` action. 3. The attacker supplies an absolute path to a process-readable sensitive file, or a symlink resolving to such a file. 4. `fs.existsSync` confirms that the target exists. 5. `fs.readFileSync` loads the complete file without authorization checks. 6. The contents are passed to `ctx.llm` through `aiReview`. 7. The sensitive data becomes available to the LLM context and potentially its remote provider, logging, or retention systems. ### Impact Assessment The vulnerability does not elevate operating-system privileges beyond those already held by the Skill process. It does, however, allow callers to cross i ...[truncated 421 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require an explicitly configured review root rather than accepting unrestricted absolute paths. 2. Resolve both the approved root and requested file with `fs.realpathSync`. 3. Verify that the resolved file remains inside the approved root using a path-aware containment check. 4. Use `fs.lstatSync` and reject symbolic links and non-regular files. 5. Allow only expected source-code extensions. 6. Explicitly reject known sensitive paths and files. 7. Impose a conservative file-size limit before reading or transmitting content. 8. Require explicit user confirmation before content is sent to an external LLM. 9. Document the configured LLM's data handling, logging, and retention behavior. 10. Perform authorization before existence checks where practical, to avoid leaking filesystem information. ]]>