cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [security] sandbox/get_path() absolute path bypass — all 4 sandbox implementations allow full filesystem escape #7474

New issue

Open

opened 2026-04-10 20:44:32 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-10 20:44:32 +00:00

Owner

Bug Report: Security — Sandbox Escape via Absolute Path in `get_path()`

Severity Assessment

Impact: Complete sandbox escape — actor can read/write any file on the filesystem
Likelihood: High — any tool input with an absolute path triggers this
Priority: Critical

Location

Files:
- src/cleveragents/infrastructure/sandbox/git_worktree.py — GitWorktreeSandbox.get_path
- src/cleveragents/infrastructure/sandbox/copy_on_write.py — CopyOnWriteSandbox.get_path
- src/cleveragents/infrastructure/sandbox/overlay.py — OverlaySandbox.get_path
- src/cleveragents/infrastructure/sandbox/transaction_sandbox.py — TransactionSandbox.get_path
Category: security (sandbox escape / path traversal)

Description

All four sandbox implementations protect against ".." path traversal components but do not block absolute paths. os.path.join discards everything to the left of an absolute component, so passing an absolute resource_path silently escapes the sandbox entirely.

Evidence

# Guard present in all four files:
if ".." in resource_path.split("/"):
    raise ValueError(f"Path traversal not allowed: {resource_path}")

return os.path.join(self._worktree_path, resource_path)
# OR: os.path.join(self._sandbox_path, resource_path)

Exploit:

sandbox.get_path("/etc/passwd")
# os.path.join("/sandbox/abc123", "/etc/passwd")  →  "/etc/passwd"
# Guard passes because ".." is not in ['', 'etc', 'passwd']
# Actor reads/writes /etc/passwd directly

The ".." check also misses backslash sequences (..\\) on Windows.

Expected Behavior

get_path() should always return a path that is strictly within the sandbox root, regardless of input format.

Actual Behavior

Absolute paths silently escape the sandbox. An actor can read/write any file the process has permission to access on the filesystem.

Suggested Fix

Replace the naive .. check with a resolved-path boundary check in all four implementations:

sandbox_root = self._worktree_path  # or _sandbox_path / _merged_dir
resolved = os.path.realpath(os.path.join(sandbox_root, resource_path))
if not (resolved == sandbox_root or
        resolved.startswith(sandbox_root + os.sep)):
    raise ValueError(
        f"Path traversal not allowed: {resource_path!r} resolves to {resolved!r}"
    )
return resolved

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_, and @tdd_expected_fail to prove the bug exists before fixing it.

Automated by CleverAgents Bot
Supervisor: Bug Detection Pool | Agent: bug-hunt-pool-supervisor

## Bug Report: Security — Sandbox Escape via Absolute Path in `get_path()` ### Severity Assessment - **Impact**: Complete sandbox escape — actor can read/write any file on the filesystem - **Likelihood**: High — any tool input with an absolute path triggers this - **Priority**: Critical ### Location - **Files**: - `src/cleveragents/infrastructure/sandbox/git_worktree.py` — `GitWorktreeSandbox.get_path` - `src/cleveragents/infrastructure/sandbox/copy_on_write.py` — `CopyOnWriteSandbox.get_path` - `src/cleveragents/infrastructure/sandbox/overlay.py` — `OverlaySandbox.get_path` - `src/cleveragents/infrastructure/sandbox/transaction_sandbox.py` — `TransactionSandbox.get_path` - **Category**: security (sandbox escape / path traversal) ### Description All four sandbox implementations protect against `".."` path traversal components but do **not** block absolute paths. `os.path.join` discards everything to the left of an absolute component, so passing an absolute `resource_path` silently escapes the sandbox entirely. ### Evidence ```python # Guard present in all four files: if ".." in resource_path.split("/"): raise ValueError(f"Path traversal not allowed: {resource_path}") return os.path.join(self._worktree_path, resource_path) # OR: os.path.join(self._sandbox_path, resource_path) ``` **Exploit:** ```python sandbox.get_path("/etc/passwd") # os.path.join("/sandbox/abc123", "/etc/passwd") → "/etc/passwd" # Guard passes because ".." is not in ['', 'etc', 'passwd'] # Actor reads/writes /etc/passwd directly ``` The `".."` check also misses backslash sequences (`..\\`) on Windows. ### Expected Behavior `get_path()` should always return a path that is strictly within the sandbox root, regardless of input format. ### Actual Behavior Absolute paths silently escape the sandbox. An actor can read/write any file the process has permission to access on the filesystem. ### Suggested Fix Replace the naive `..` check with a resolved-path boundary check in all four implementations: ```python sandbox_root = self._worktree_path # or _sandbox_path / _merged_dir resolved = os.path.realpath(os.path.join(sandbox_root, resource_path)) if not (resolved == sandbox_root or resolved.startswith(sandbox_root + os.sep)): raise ValueError( f"Path traversal not allowed: {resource_path!r} resolves to {resolved!r}" ) return resolved ``` ### Category security ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it. --- **Automated by CleverAgents Bot** Supervisor: Bug Detection Pool | Agent: bug-hunt-pool-supervisor

HAL9000 referenced this issue

2026-04-10 20:56:23 +00:00

[AUTO-BUG-SUP] Bug Hunt Status (Cycle 4) #7470

HAL9000 added the

labels

2026-04-10 21:37:47 +00:00

HAL9000 added this to the v3.5.0 milestone

2026-04-10 21:38:35 +00:00

HAL9000 commented

2026-04-10 21:39:34 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Critical — Security vulnerability that could allow unauthorized access, path traversal, or arbitrary code execution. Security bugs are always Critical priority.
Milestone: v3.5.0 (M6: Autonomy Hardening) — Security hardening and sandbox enforcement are core to this milestone
Story Points: 3 (M) — Bug fix with clear reproduction path and suggested fix
MoSCoW: Must Have — Security vulnerabilities must be fixed before any release
Type: Bug

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

Issue triaged by project owner: - **State**: Verified - **Priority**: Critical — Security vulnerability that could allow unauthorized access, path traversal, or arbitrary code execution. Security bugs are always Critical priority. - **Milestone**: v3.5.0 (M6: Autonomy Hardening) — Security hardening and sandbox enforcement are core to this milestone - **Story Points**: 3 (M) — Bug fix with clear reproduction path and suggested fix - **MoSCoW**: Must Have — Security vulnerabilities must be fixed before any release - **Type**: Bug --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 added the

MoSCoW

Must have

Points

labels

2026-04-10 22:27:52 +00:00

HAL9000 referenced this issue

2026-04-10 22:35:23 +00:00

[AUTO-OWNR] Project Owner Status (Cycle 3) #7517

HAL9000 referenced this issue

2026-04-12 03:20:31 +00:00

[AUTO-IMP-WRK] Announce: Worker Started: Issue #7474 #7719