| 标题 | heshengtao super-agent-party 0.4.1 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| 描述 | # Technical Details
An Arbitrary Local File Read via `get_file_content` Tool Dispatch exists in the `get_content()` and `handle_local_file()` functions in `py/load_files.py` of super-agent-party.
The application fails to validate non-HTTP file paths before opening them. The `get_content()` helper only distinguishes whether the supplied `input_str` starts with `http://` or `https://`. Any other value is treated as a local filesystem path and passed directly to `handle_local_file()`, which opens the attacker-controlled path via `open(file_path, 'rb')` and returns its contents. The backend has URL-side SSRF protections for HTTP targets, but equivalent path validation is missing for raw filesystem paths.
# Vulnerable Code
File: py/load_files.py
Method: get_content() — routes any non-HTTP input to handle_local_file(); handle_local_file() — passes caller-controlled path into _read_file(); _read_file() — performs open(file_path, 'rb') on attacker-controlled input
Why: The routing logic only classifies HTTP URLs as remote and falls back to local file handling for everything else, with no allowlist, path containment, or scheme validation.
# Reproduction
1. Start the backend: `server.py --host 127.0.0.1 --port 3456`.
2. Send `POST /execute_tool_manually` with `{"tool_name":"get_file_content","tool_params":{"file_url":"/path/to/canary.txt"},"approval_type":"once"}`.
3. Observe the response contains the canary file contents.
4. Confirm a control request using `http://127.0.0.1/...` is rejected with "安全拒绝: 不允许访问内部网络地址".
# Impact
- Arbitrary local file read affecting any readable file that the backend process user can access.
- Exposes application configuration, uploaded data, stored task/workspace material, API keys, and integration credentials.
- In shared or remotely accessible deployments, enables cross-user confidentiality breach and further compromise. |
|---|
| 来源 | ⚠️ https://gist.github.com/YLChen-007/479bfabb441bd6cc5337db910b004841 |
|---|
| 用户 | JohnChen (UID 99088) |
|---|
| 提交 | 2026-06-18 09時01分 (2 月前) |
|---|
| 管理 | 2026-08-05 20時56分 (2 months later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 386263 [heshengtao super-agent-party 直到 0.4.1 execute_tool_manually Endpoint server.py get_file_content tool_name/tool_params 信息公开] |
|---|
| 积分 | 0 |
|---|