| 标题 | netease-youdao LobsterAI 2026.6.10 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| 描述 | # Technical Details
An arbitrary local file read vulnerability exists in the artifact loading pipeline of LobsterAI. The `src/renderer/services/artifactParser.ts` module parses `MEDIA:` file references from assistant or tool output messages and stores the resulting path in `artifact.filePath` without any trust or workspace validation. The `src/renderer/components/cowork/CoworkSessionDetail.tsx` component then auto-loads these file-backed artifacts on session open, treating absolute paths as trusted and forwarding them into `window.electron.dialog.readFileAsDataUrl(absPath)`. The Electron main process in `src/main/main.ts` then services the IPC call by resolving and reading the path from disk with no workspace containment or allowlist root check.
# Vulnerable Code
File: src/renderer/services/artifactParser.ts (lines 272-320)
Method: parseMediaTokensFromText()
Why: Accepts untrusted `MEDIA:` and `file://` paths and stores them in `artifact.filePath` without workspace validation.
File: src/renderer/components/cowork/CoworkSessionDetail.tsx (lines 1786-1831)
Method: CoworkSessionDetail auto-loader
Why: Treats absolute parsed paths as trusted and forwards them to `readFileAsDataUrl` automatically on session open.
File: src/main/main.ts (lines 8186-8210)
Method: dialog:readFileAsDataUrl IPC handler
Why: Resolves and reads the supplied path with `fs.promises.readFile()` without restricting to session workspace or approved allowlist root.
# Reproduction
1. Build LobsterAI Electron application from source.
2. Seed a malicious assistant message containing `MEDIA: /absolute/path/to/sensitive/file` into the session SQLite database.
3. Open the Cowork session in the desktop application.
4. Verify via strace that `statx` and `openat` syscalls are issued against the canary file outside the workspace.
5. Confirm the control case (relative path only) produces no outside canary trace hit.
# Impact
- Arbitrary local file read / information disclosure in a desktop AI assistant.
- Any local file readable by the user account can be accessed, including source code, logs, user documents, and secrets.
- Data pulled into the Artifact pipeline may be exposed to later preview, copy, share, or model-ingestion flows. |
|---|
| 来源 | ⚠️ https://github.com/netease-youdao/LobsterAI/issues/2176 |
|---|
| 用户 | ChenMarry (UID 99089) |
|---|
| 提交 | 2026-06-18 09時35分 (2 月前) |
|---|
| 管理 | 2026-08-05 21時31分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 386378 [netease-youdao LobsterAI 2026.6.10 MEDIA Path artifactParser.ts parseMediaTokensFromText 信息公开] |
|---|
| 积分 | 20 |
|---|