| Titre | TinyAGI tinyagi 0.0.20 External Control of File Name or Path (CWE-73) |
|---|
| Description | # Technical Details
An arbitrary local file disclosure vulnerability exists in TinyAGI's agent configuration API. The unauthenticated `PUT /api/agents/:id` route in `packages/server/src/routes/agents.ts` accepts caller-supplied JSON and persists `prompt_file` directly into the agent configuration without authentication, path allowlist, canonicalization, or containment check. Later, when any user sends `POST /api/message` for that agent, `invokeAgent()` in `packages/core/src/invoke.ts` forwards the persisted `agent.prompt_file` into `buildSystemPrompt()` in `packages/core/src/agent.ts`. That function reads the attacker-controlled path with `fs.readFileSync()` and appends the file contents to the system prompt sent to the model provider.
# Vulnerable Code
File: packages/server/src/routes/agents.ts (lines 56-64)
Method: PUT /api/agents/:id handler
Why: The unauthenticated agent update route persists attacker-controlled `prompt_file` into the saved agent configuration.
File: packages/core/src/invoke.ts (lines 201-202)
Method: invokeAgent()
Why: Forwards the persisted `agent.prompt_file` into prompt construction during a normal message execution path.
File: packages/core/src/agent.ts (lines 208-215)
Method: buildSystemPrompt()
Why: Reads the attacker-chosen path with `fs.readFileSync()` and appends its contents to the outbound system prompt.
# Reproduction
1. Start TinyAGI daemon.
2. Send `PUT /api/agents/:id` with `{"prompt_file": "/tmp/sensitive.txt", ...}` to set an attacker-chosen local file path.
3. Send `POST /api/message` for that agent to trigger a normal message execution.
4. Capture the outbound provider request — confirm it contains the canary from the target file.
5. Observe the assistant response contains `LEAKED_CANARY`.
6. Confirm control case (no `prompt_file` configured) shows `provider_contains_canary: false`.
# Impact
- Arbitrary local file disclosure reachable through unauthenticated network API.
- Remote caller can change agent's `prompt_file`, read local files, and exfiltrate contents to the model provider.
- Can expose workspace documents, source code, operational notes, API credentials, and other local secrets. |
|---|
| La source | ⚠️ https://github.com/TinyAGI/tinyagi/issues/283 |
|---|
| Utilisateur | JondaChen (UID 99096) |
|---|
| Soumission | 18/06/2026 10:49 (il y a 2 mois) |
|---|
| Modérer | 05/08/2026 22:20 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 386404 [TinyAGI 0.0.20 agents.ts buildSystemPrompt élévation de privilèges] |
|---|
| Points | 20 |
|---|