Workspace Guard Bypass via Symlink in Jan Agent Tools

Executive Summary

This vulnerability is a workspace guard bypass in Jan versions 0.8.5 to 0.8.8. It allows attackers to write files outside the intended workspace by exploiting dangling symlinks. Attackers can use prompt injection to trick the write or edit tools into following malicious symlinks, potentially creating files like ~/.ssh/authorized_keys on the host system.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file writes outside the workspace, especially in sensitive directories like ~/.ssh/. Look for symlinks created by the Jan application in version 0.8.5 before 0.8.8. Review logs for prompt injection attempts or unexpected tool usage.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to write arbitrary files to sensitive locations on your system, such as user directories or system files. This may lead to unauthorized access, data theft, or further compromise of the system if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes outside the intended workspace, potentially exposing sensitive data like SSH keys or configuration files. For GDPR, this may violate data integrity and confidentiality principles if personal data is accessed or modified without authorization. For HIPAA, unauthorized file writes could compromise protected health information if stored outside secure environments.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Jan to version 0.8.8 or later to patch the vulnerability. Restrict write permissions to workspace directories. Monitor for suspicious symlink creation or file writes outside expected paths. Disable unnecessary tools or features that allow file operations.

Useful 0 Not Useful 0