Отправить #855797: Poco AI poco-agent 0.5.4 Authorization Bypass Through User-Controlled Key (CWE-639)

# Technical Details
An authorization bypass / insecure direct object reference exists in the `get_workspace_file` API route in `executor_manager/app/api/v1/workspace.py` of poco-agent.

The application fails to bind the caller identity to the requested workspace. The route accepts attacker-controlled `user_id` and `session_id` from the URL and forwards them into `WorkspaceManager.resolve_workspace_file()` without authentication or authorization checks. Although the code validates that `path` stays within the chosen workspace directory, it fully trusts the supplied `user_id` when selecting which user's workspace to read from `WORKSPACE_ROOT/active/{user_id}/{session_id}/workspace`.

# Vulnerable Code
File: `executor_manager/app/api/v1/workspace.py`
Method: `get_workspace_file`
Why: The route `@router.get("/file/{user_id}/{session_id}")` takes `user_id`, `session_id`, and `path` directly from the request, then calls `workspace_manager.resolve_workspace_file(user_id=user_id, session_id=session_id, file_path=path)` with no trusted identity verification.

File: `executor_manager/app/services/workspace_manager.py`
Method: `resolve_workspace_file`
Why: The resolver uses `get_session_workspace_dir(user_id=user_id, session_id=session_id)` to select the workspace root. It only enforces filesystem containment on `path` via resolved path checks, but it does not verify whether the requester is authorized to access the specified `user_id` and `session_id`.

# Reproduction
1. Deploy or start a reachable `executor_manager` service and prepare a victim workspace under `WORKSPACE_ROOT/active/victim-user/<victim-session-id>/workspace/` containing a file such as `secrets.txt`.
2. Send a control request using an attacker identity for a non-existent attacker workspace and observe a `400 Workspace not found` response.
3. Send a forged request such as `GET /api/v1/workspace/file/victim-user/<victim-session-id>?path=secrets.txt` while unauthenticated or as another user.
4. Observe that the server returns `200` and discloses the victim file contents.
5. Confirm the issue with the provided verification scripts referenced in the report, where the baseline request fails but the forged victim request succeeds.

# Impact
- Any caller who can reach the workspace API can read another user's workspace files by swapping the `user_id` path segment and providing a valid or guessable `session_id` and file name.
- Exposed files may include source code, task artifacts, generated patches, uploaded inputs, debug logs, and embedded credentials.
- The same trust pattern reportedly affects sibling workspace operations such as listing, archive, delete, and user workspace enumeration, expanding the broken access control impact beyond read-only disclosure.

• Источник: ⚠️ https://github.com/poco-ai/poco-claw/issues/133
• Пользователь: Eric-b (UID 96354)
• Представление: 11.06.2026 09:09 (1 месяц назад)
• Модерация: 13.07.2026 19:01 (1 month later)
• Статус: принято
• Запись VulDB: 378125 [poco-ai poco-claw до 0.5.4 Workspace API workspace.py get_workspace_file user_id эскалация привилегий]
• Баллы: 20