T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sagemaker_train.py:317- Finding
S3 Object Keys Can Escape the Local Artifact Directory
- Content
View full analysis
{local}") s3.download_file(bucket, key, str(local)) ``` ### Technical Analysis The relative local path is derived directly from an S3 object key. Although the object listing is constrained by an S3 prefix, the remaining key can contain traversal components such as `../`. Joining such a value with `output_dir` does not guarantee that the resulting path remains beneath that directory. The code does not resolve the destination path or perform a containment check before creating parent directories and downloading the object. For example, an object key resembling: ```text sagemaker/output/JOB/../../.config/example ``` can produce a destination outside the intended output directory. Exploitation requires an attacker, compromised training process, or other principal to have permission to create objects under the downloaded S3 prefix. ### Attack Path 1. A training job, compromised execution role, or another bucket writer creates an S3 object under the artifact prefix. 2. The portion after the expected prefix contains one or more `../` path components. 3. The user completes or resumes the affected SageMaker job with artifact downloading enabled. 4. `download_artifacts()` constructs the local destination without canonicalization. 5. The AWS SDK writes the object outside the selected output directory. ### Impact Assessment The attacker can overwrite or create files accessible to the operating-system account running the Skill. T ...[truncated 378 chars]- Remediation
View remediation