T02 · Agent Memory Poisoning
Error
- Location
ui/server.py:128- Finding
Unauthenticated Local API Allows Persistent Workflow Instruction Poisoning
- Content
View full analysis
None: parsed = urlparse(self.path) path = unquote(parsed.path) if path == "/api/workflows": return self.handle_save_workflow() if path == "/api/match": return self.handle_match_workflows() if path == "/api/capture-draft": return self.handle_capture_draft() if path == "/api/render-brief": return self.handle_render_brief() self.respond_error(HTTPStatus.NOT_FOUND, "Unknown endpoint.") ``` Attacker-supplied workflow content is validated only for a name and syntactically safe identifier, then written directly to the workflow library: ```python # ui/server.py:158-178 def handle_save_workflow(self) -> None: body = self.read_json_body() if body is None: return original_id = body.pop("_original_id", None) try: workflow = validate_workflow(body) destination = workflow_path(self.config.workflows_dir, workflow["id"]) except ValueError as exc: return self.respond_error(HTTPStatus.BAD_REQUEST, str(exc)) if original_id and original_id != workflow["id"]: try: old_path = workflow_path(self.config.workflows_dir, original_id) except ValueError as exc: return self.respond_error(HTTPStatus.BAD_REQUEST, str(exc)) if old_path.exists(): old_path.unlink() destination.write_text(json.dumps(workflow, indent=2) + "\n", encoding="utf-8") self.respond_json({"ok": True, "id": workflow["id"]}) ``` The request parser accepts JSON without requiring ...[truncated 6119 chars]- Remediation
View remediation