| Titolo | heshengtao super-agent-party 0.4.1 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| Descrizione | # Technical Details
An arbitrary local file read vulnerability exists in the `get_file_content` tool handler in `py/load_files.py` of super-agent-party.
The `POST /execute_tool_manually` endpoint accepts user-controlled `tool_name` and `tool_params`, dispatching to the backend tool registry. The `get_content()` helper only treats `http://` and `https://` values as remote URLs; every other value is implicitly trusted as a local path and opened directly via `handle_local_file()`. The `handle_local_file()` function then performs a direct `open(file_path, 'rb')` on the attacker-controlled path without any root restriction, sandboxing, or allowlist.
# Vulnerable Code
File: py/load_files.py (Lines 201-220)
Method: `get_content()` → `handle_local_file()` → `_read_file()`
Why: `get_content()` routes any non-HTTP(S) input to `handle_local_file()` based only on `input_str.startswith(('http://', 'https://'))`. `handle_local_file()` performs `os.path.exists(file_path)` then `open(file_path, 'rb')` on the attacker-supplied path with no containment check. The backend already has URL-side SSRF protections but does not apply equivalent validation to non-HTTP input.
File: server.py (Lines 6527-6543)
Method: Backend tool registry / manual execution dispatcher
Why: `_TOOL_HOOKS` maps `"get_file_content"` to the vulnerable `get_file_content` function, making it callable through the public manual tool execution API.
# Reproduction
1. Start the super-agent-party backend: `.venv/bin/python server.py --host 127.0.0.1 --port 3456`.
2. Create a canary file with known content on the target host.
3. Send `POST /execute_tool_manually` with JSON body: `{"tool_name":"get_file_content","tool_params":{"file_url":"/path/to/canary.txt"},"approval_type":"once"}`.
4. Observe HTTP 200 with the canary file contents in the response body.
5. Run the control with `file_url` set to `http://127.0.0.1/...` — confirm the backend blocks the internal-network URL with `"安全拒绝: 不允许访问内部网络地址"`, proving the backend has SSRF protections but lacks equivalent local-path validation.
# Impact
- Attackers can read any file readable by the backend process user, including application configuration, uploaded data, stored task/workspace material, and files containing secrets.
- In shared or remotely accessible deployments, enables cross-user confidentiality breach.
- Can serve as a stepping stone for further compromise. |
|---|
| Fonte | ⚠️ https://gist.github.com/YLChen-007/479bfabb441bd6cc5337db910b004841 |
|---|
| Utente | Erichen-x (UID 99082) |
|---|
| Sottomissione | 18/06/2026 04:45 (2 mesi fa) |
|---|
| Moderazione | 05/08/2026 18:10 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 386263 [heshengtao super-agent-party fino a 0.4.1 execute_tool_manually Endpoint server.py get_file_content tool_name/tool_params rivelazione di informazioni] |
|---|
| Punti | 20 |
|---|