aether-ai-agent
b5f551d716
fix(security): OC-06 prevent path traversal in config includes
Fixed CWE-22 path traversal vulnerability allowing arbitrary file reads
through the $include directive in OpenClaw configuration files.
Security Impact:
- CVSS 8.6 (High) - Arbitrary file read vulnerability
- Attack vector: Malicious config files with path traversal sequences
- Impact: Exposure of /etc/passwd, SSH keys, cloud credentials, secrets
Implementation:
- Added path boundary validation in resolvePath() (lines 169-198)
- Implemented symlink resolution to prevent bypass attacks
- Restrict includes to config directory only
- Throw ConfigIncludeError for escaping paths
Testing:
- Added 23 comprehensive security tests
- 48/48 includes.test.ts tests passing
- 5,063/5,063 full suite tests passing
- 95.55% coverage on includes.ts
- Zero regressions, zero breaking changes
Attack Vectors Blocked:
✓ Absolute paths (/etc/passwd, /etc/shadow)
✓ Relative traversal (../../etc/passwd)
✓ Symlink bypass attempts
✓ Home directory access (~/.ssh/id_rsa)
Legitimate Use Cases Preserved:
✓ Same directory includes (./config.json)
✓ Subdirectory includes (./clients/config.json)
✓ Deep nesting (./a/b/c/config.json)
Aether AI Agent Security Research
2026-02-18 03:27:16 +01:00
..
2026-02-18 01:34:35 +00:00
2026-02-18 03:21:52 +01:00
2026-02-18 01:50:11 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-17 21:10:38 -05:00
2026-02-18 01:34:35 +00:00
2026-02-18 03:27:16 +01:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-16 02:45:00 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-16 02:45:00 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-17 00:53:44 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-16 02:45:00 +00:00
2026-02-16 00:08:00 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-17 15:50:07 +09:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:05:36 +01:00
2026-02-18 01:34:35 +00:00
2026-02-15 00:56:20 +00:00
2026-02-16 22:35:27 -05:00
2026-02-18 01:34:35 +00:00
2026-02-18 01:34:35 +00:00
2026-02-17 11:22:49 +09:00
2026-02-16 02:45:00 +00:00