| タイトル | TinyAGI tinyagi 0.0.20 External Control of File Name or Path (CWE-73) |
|---|
| 説明 | # Technical Details
An arbitrary file disclosure vulnerability exists in TinyAGI's response attachment pipeline. The public `POST /api/message` endpoint in `packages/server/src/routes/messages.ts` accepts unauthenticated attacker input. The response processing in `packages/core/src/response.ts` uses `collectFiles()` to parse `[send_file: <path>]` tags from agent/provider output. The function extracts the raw path and adds it to the outgoing `files` set if `fs.existsSync(filePath)` returns true — with no canonicalization, allowlist, or directory containment check. `streamResponse()` then strips the visible tag and persists the path into `responses.files`. Channel workers in `packages/channels/src/telegram.ts`, `discord.ts`, and `whatsapp.ts` consume the path directly for outbound attachment delivery via `InputFile`, `AttachmentBuilder`, and `MessageMedia.fromFilePath`.
# Vulnerable Code
File: packages/core/src/response.ts (lines 37-43)
Method: collectFiles()
Why: Extracts raw `[send_file: ...]` paths from agent/provider output and accepts any existing host path without validation.
File: packages/core/src/response.ts (lines 67-89)
Method: streamResponse()
Why: Strips the visible tag and persists the extracted file path into `responses.files` for later delivery.
File: packages/channels/src/telegram.ts (lines 498-529)
Method: Telegram worker
Why: Reads `resp.files` and hands each path directly to `new InputFile(file)` for outbound attachment delivery.
# Reproduction
1. Start TinyAGI daemon with a Telegram channel configured.
2. Send `POST /api/message` with a message that causes the agent/provider to emit `[send_file: /etc/hosts]`.
3. Retrieve pending responses via `GET /api/responses/pending?channel=telegram`.
4. Observe `files: ["/etc/hosts"]` queued for outbound delivery.
5. Confirm control case (no `[send_file: ...]` tag) produces no `files` field.
# Impact
- Arbitrary local file exposure through the outbound attachment pipeline.
- Files readable by the TinyAGI process can be queued for delivery through Telegram, Discord, or WhatsApp.
- Can expose local configuration, logs, workspace data, API credentials, and other sensitive host content.
- Unauthenticated and network-reachable through the public HTTP API. |
|---|
| ソース | ⚠️ https://github.com/TinyAGI/tinyagi/issues/282 |
|---|
| ユーザー | JondaChen (UID 99096) |
|---|
| 送信 | 2026年06月18日 10:48 (2 月 ago) |
|---|
| モデレーション | 2026年08月05日 22:20 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 386402 [TinyAGI 0.0.20 Message API Endpoint response.ts collectFiles 特権昇格] |
|---|
| ポイント | 20 |
|---|