Invia #864288: Roo-Code v3.51.1 Path Traversal

### Description

Roo-Code's ApplyPatchTool does not validate file paths in patch files, allowing attackers to modify files outside the workspace boundary through path traversal attacks. The tool uses `path.resolve(task.cwd, relPath)` to construct file paths without validating that the resolved path remains within the workspace.

Vulnerable code location:
```typescript
// src/core/tools/ApplyPatchTool.ts:85
const targetPath = path.resolve(task.cwd, relPath); // ❌ No boundary check
```

The vulnerability chain:
1. `ApplyPatchTool` resolves relative paths without boundary checking (ASI05-001)
2. Workspace boundary check (SF-10) is only implemented in WriteToFileTool, not ApplyPatchTool
3. No validation that resolved path is within workspace
4. Patch files from untrusted sources are processed without sanitization

This allows attackers to distribute malicious patch files that modify critical system files (e.g., `~/.ssh/authorized_keys`, `~/.bashrc`) when victims apply them, achieving persistent system access.

### Root cause

- Entry route:
Patch file application via ApplyPatchTool
- Preconditions:
Victim downloads and applies malicious patch file
- Vulnerable code:
`src/core/tools/ApplyPatchTool.ts:85` - Path resolution without boundary check
- Root cause:
ApplyPatchTool resolves relative paths without validating that the resolved path remains within the workspace boundary
- Controlling factor:
Workspace boundary check (SF-10) not implemented in ApplyPatchTool

### Proof of Concept

**Malicious Patch File (malicious.patch):**

```diff
--- ../../.ssh/authorized_keys
+++ ../../.ssh/authorized_keys
@@ -1,0 +1,1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8h3fj2kF... [email protected]
```

**Attack Steps:**
1. Attacker creates malicious patch file with path traversal sequences (`../`)
2. Patch is distributed via social engineering:
- Email: "Urgent security fix for your project"
- GitHub issue: "Please apply this performance patch"
- Slack/Discord: "Here's the fix for that bug"
- Pull request comment: "Apply this patch to resolve the issue"
3. Victim downloads the patch file to their workspace
4. Victim asks Roo-Code: "Please apply the patch file malicious.patch"
5. Agent calls ApplyPatchTool with the malicious patch
6. Tool resolves `../../.ssh/authorized_keys` without boundary validation
7. Patch is applied, modifying file outside workspace
8. Attacker's SSH public key is added to `~/.ssh/authorized_keys`
9. Attacker gains persistent SSH access to victim's machine

### Expected behaviour

ApplyPatchTool should validate that all file paths in patch files remain within the workspace boundary and reject patches with path traversal sequences.

### Observed behaviour

Agent executes `patch < malicious.patch`, resolves path traversal sequences, modifies files outside workspace (e.g., `~/.ssh/authorized_keys`), and reports success without any warning or boundary check failure.

### CWE Classification

- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
- CWE-73: External Control of File Name or Path
- CWE-434: Unrestricted Upload of File with Dangerous Type

• Fonte: ⚠️ https://gist.github.com/tchen200311/c5b8eeb9b7f8e4e6f19e7432d7bb1e31
• Utente: tchen200311 (UID 97733)
• Sottomissione: 20/06/2026 04:01 (2 mesi fa)
• Moderazione: 27/08/2026 16:50 (2 months later)
• Stato: Accettato
• Voce VulDB: 396170 [RooCodeInc Roo-Code fino a 3.51.1 ApplyPatchTool ApplyPatchTool.ts path.resolve directory traversal]
• Punti: 20