Link Following in Open Multi Agent Core

Executive Summary

This vulnerability affects open-multi-agent versions 1.5.0 through 1.21.2. It involves a sandbox escape in the file_write tool where attackers can exploit dangling symlinks to create files outside the intended workspace root. By planting a dangling symlink in the workspace and using prompt injection, an attacker can manipulate the agent into writing files to arbitrary locations where the agent process has write permissions.

Useful 0 Not Useful 0

Detection Guidance

Check for open-multi-agent versions between 1.5.0 and 1.21.2 using package managers like npm or yarn. Inspect workspace directories for suspicious symlinks or files outside the intended sandbox. Review agent logs for unexpected file writes or prompt injection attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to write files outside the sandboxed workspace directory. This could lead to unauthorized file creation, modification, or overwriting of sensitive files like configuration files, source code, or environment variables. Attackers could potentially execute arbitrary code or escalate privileges by manipulating files in critical system locations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for data protection and integrity. For GDPR, it may result in unauthorized processing or exposure of personal data. For HIPAA, it could allow unauthorized access to protected health information, leading to breaches and non-compliance with security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade open-multi-agent to a patched version beyond 1.21.2. Disable the sandbox only if absolutely necessary. Implement strict input validation for agent prompts to prevent prompt injection. Monitor file system changes in workspace directories for unauthorized writes.

Useful 0 Not Useful 0