Summary
PraisonAI's GitHub template cache resolves user-controlled repository references without normalizing path segments or confirming that the resulting path stays within the cache directory. An attacker who can supply a crafted template reference may write cache metadata outside the intended directory or delete an attacker-selected directory when the expected cache hierarchy already exists.
PraisonAI's GitHub template cache resolves user-controlled repository references without normalizing path segments or confirming that the resulting path stays within the cache directory. An attacker who can supply a crafted template reference may write cache metadata outside the intended directory or delete an attacker-selected directory when the expected cache hierarchy already exists.
Affected context
The vulnerability occurs in PraisonAI deployments that load templates through GitHub-style URIs containing user-controlled owner, repository, template, or ref components. It becomes risky when those values are incorporated into local cache paths without canonicalization and containment checks, particularly when the cache cleanup logic can operate on a path outside the intended template cache root.
The vulnerability occurs in PraisonAI deployments that load templates through GitHub-style URIs containing user-controlled owner, repository, template, or ref components. It becomes risky when those values are incorporated into local cache paths without canonicalization and containment checks, particularly when the cache cleanup logic can operate on a path outside the intended template cache root.
Exploit preconditions
- Attack surface: PraisonAI's GitHub template loading and local cache handling
- Required access: Ability to provide or influence a template URI or its ref component
- Trigger point: Template resolution and subsequent cache creation or cleanup
- Why exploitation is possible: Traversal segments are joined into filesystem paths without normalization or verification that the resolved path remains within the trusted cache root
- Additional condition for deletion: The normal cache hierarchy for the relevant owner, repository, and template must already exist so cleanup can reach the selected outside path
- Attack surface: PraisonAI's GitHub template loading and local cache handling
- Required access: Ability to provide or influence a template URI or its ref component
- Trigger point: Template resolution and subsequent cache creation or cleanup
- Why exploitation is possible: Traversal segments are joined into filesystem paths without normalization or verification that the resolved path remains within the trusted cache root
- Additional condition for deletion: The normal cache hierarchy for the relevant owner, repository, and template must already exist so cleanup can reach the selected outside path
Why this happens
The underlying bug is improper neutralization of user-controlled path components, mapping primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The resolver preserves a user-controlled ref verbatim, while the cache layer concatenates path segments and performs filesystem operations without canonicalizing the result and enforcing directory containment. This also relates to CWE-73: External Control of File Name or Path, because an externally influenced template reference determines where files and directories are written or removed.
The underlying bug is improper neutralization of user-controlled path components, mapping primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The resolver preserves a user-controlled ref verbatim, while the cache layer concatenates path segments and performs filesystem operations without canonicalizing the result and enforcing directory containment. This also relates to CWE-73: External Control of File Name or Path, because an externally influenced template reference determines where files and directories are written or removed.
Potential impact
- An attacker may cause cache metadata to be written outside the intended cache directory.
- An attacker could delete a selected directory if the cache cleanup path reaches it.
- Local application data or configuration could be damaged or removed.
- Subsequent application behavior may be disrupted through cache poisoning or unexpected filesystem changes.
- A deletion or write operation could contribute to broader compromise if higher-privilege paths are reachable.
- An attacker may cause cache metadata to be written outside the intended cache directory.
- An attacker could delete a selected directory if the cache cleanup path reaches it.
- Local application data or configuration could be damaged or removed.
- Subsequent application behavior may be disrupted through cache poisoning or unexpected filesystem changes.
- A deletion or write operation could contribute to broader compromise if higher-privilege paths are reachable.
General mitigation guidance
Mitigation generally focuses on treating all template URI components as untrusted filesystem input.
Common defensive patterns include:
- Canonicalizing candidate paths before any write, replacement, or deletion operation.
- Verifying that the resolved path is strictly contained within a designated cache root.
- Rejecting traversal components, absolute paths, ambiguous separators, and other unsafe path forms.
- Using trusted identifiers or generated cache keys instead of directly embedding user-controlled refs in filesystem paths.
- Applying the same containment checks to cleanup and deletion paths, not only to file creation.
- Restricting the process filesystem permissions and running with the least privilege needed for template caching.
- Keeping cache directories isolated from sensitive application data and system locations.
Mitigation generally focuses on treating all template URI components as untrusted filesystem input.
Common defensive patterns include:
- Canonicalizing candidate paths before any write, replacement, or deletion operation.
- Verifying that the resolved path is strictly contained within a designated cache root.
- Rejecting traversal components, absolute paths, ambiguous separators, and other unsafe path forms.
- Using trusted identifiers or generated cache keys instead of directly embedding user-controlled refs in filesystem paths.
- Applying the same containment checks to cleanup and deletion paths, not only to file creation.
- Restricting the process filesystem permissions and running with the least privilege needed for template caching.
- Keeping cache directories isolated from sensitive application data and system locations.
How teams detect issues like this
High-level detection can include:
- Static analysis for filesystem joins that consume externally controlled URI, ref, or repository components without canonicalization.
- Code review checks for cleanup functions such as recursive directory removal operating on derived paths.
- Tests using traversal markers, absolute-path variants, encoded separators, and platform-specific path syntax to verify containment enforcement.
- Runtime monitoring for cache operations targeting paths outside the configured cache root.
- Policy enforcement requiring canonical-path validation before file writes, renames, replacements, or recursive deletion.
- Automated security review tools can help identify external path control and missing directory-boundary checks.
High-level detection can include:
- Static analysis for filesystem joins that consume externally controlled URI, ref, or repository components without canonicalization.
- Code review checks for cleanup functions such as recursive directory removal operating on derived paths.
- Tests using traversal markers, absolute-path variants, encoded separators, and platform-specific path syntax to verify containment enforcement.
- Runtime monitoring for cache operations targeting paths outside the configured cache root.
- Policy enforcement requiring canonical-path validation before file writes, renames, replacements, or recursive deletion.
- Automated security review tools can help identify external path control and missing directory-boundary checks.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
