agent-device: is install_from_source kind:path an arbitrary daemon-host file read over /rpc?

3 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Status: the issue is closed as COMPLETED, but the thread itself shows no fix commit or PR — the maintainer triage directed the fix, so verify against current main.

  Root cause: on the HTTP surface, parseInstallSource (src/daemon/server/http-server.ts) returned { kind: 'path', path } after only a non-empty check, and materializeLocalSource (src/platforms/install-source.ts) returned expandUserHomePath(source.path) with no confinement. The url kind had hygiene (credentials rejected, blocked hostnames, DNS-resolved non-public-address rejection, redirect caps, HTTPS-downgrade blocks); the path kind had none. Any authenticated caller reaching /rpc could name a daemon-user-readable path and have its bytes flow back through the install pipeline.

  The accepted fix direction (comment 2): reject source.kind = "path" unconditionally at the HTTP boundary with INVALID_ARGS, leave the trusted local callers unchanged (admin.ts and diff-screenshot.ts build path sources locally and never cross that boundary), and retain local-path regression coverage. Do not add an opt-in allowHostPathInstall / allowlist-root config surface without separate approval — the reporter's proposed opt-in design was explicitly deferred.

  Security note: before this fix, anyone with a valid token who could reach /rpc could read arbitrary daemon-user-readable files; keep daemon tokens scoped to trusted tenants.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @thymikee tried on GitHub (Outcome unclear)

  Maintainer triage against current main d44df9b588 confirmed the issue and directed the accepted fix: reject source.kind = "path" unconditionally at the HTTP boundary (INVALID_ARGS), do not add an opt-in host-path config surface without separate approval, and keep local-path regression coverage. No commit or PR is referenced in the thread, so the landing of the fix is not confirmed here.

  Source: https://github.com/callstack/agent-device/issues/2097#issuecomment-5441380068 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Outcome unclear)

  Reporter demonstrated the vulnerability at commit 848c6ea733 by tracing the kind: "path" branch in parseInstallSource (non-empty check only) and materializeLocalSource (expandUserHomePath, no confinement), and proposed gating path installs at the HTTP boundary plus an allowlist root behind an opt-in flag.

  Source: https://github.com/callstack/agent-device/issues/2097 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport