Labels: security, integrity
Severity: S1. Paths where untrusted content is executed, trusted without verification, or fed back into a model.
| Finding (path:line) |
Issue |
modules/malware/services/playbook_runner.py:199-205 |
_run_step dispatches any step.tool string to mcp_dispatch with no allowlist -> a promoted playbook with a crafted tool name attempts arbitrary MCP dispatch |
modules/forensics/services/file_retriever.py:104-300 |
After SFTP-downloading extracted evidence, the analyzer-reported SHA-256 is trusted with no local re-hash -> a corrupted transfer or compromised analyzer delivers bad bytes with a valid-looking hash; chain-of-custody break in a DFIR context |
modules/forensics/tools/script_tool.py:95-105 |
A non-zero exit returns {"exit_code":1,...} as a normal dict and never raises -> a syntax-errored script reads as an empty-output success, steering the investigator to false-negative conclusions |
tools/aila_fuzz_reporter/scrapers/fuzzilli.py:87-94 |
iterdir() follows symlinks with no resolve()/is_relative_to() guard -> a symlink in crashes/ leaks arbitrary host file content (up to 64KB) into the reported payload preview |
modules/malware/agents/narrative_agent.py:361-365 |
LLM narrative (up to 60KB) written unsanitized to payload_json, later read as trusted context by downstream agents -> indirect prompt-injection chain (tool result -> narrative -> next LLM call) |
Acceptance: playbook tool names validated against an allowlist; forensic files re-hashed locally after download and mismatch fails closed; script non-zero exit surfaced as an error to the agent; fuzz scrapers reject symlinks escaping the storage root; narrative text sanitized/classified before re-injection.
Labels: security, integrity
Severity: S1. Paths where untrusted content is executed, trusted without verification, or fed back into a model.
modules/malware/services/playbook_runner.py:199-205_run_stepdispatches anystep.toolstring tomcp_dispatchwith no allowlist -> a promoted playbook with a crafted tool name attempts arbitrary MCP dispatchmodules/forensics/services/file_retriever.py:104-300modules/forensics/tools/script_tool.py:95-105{"exit_code":1,...}as a normal dict and never raises -> a syntax-errored script reads as an empty-output success, steering the investigator to false-negative conclusionstools/aila_fuzz_reporter/scrapers/fuzzilli.py:87-94iterdir()follows symlinks with noresolve()/is_relative_to()guard -> a symlink incrashes/leaks arbitrary host file content (up to 64KB) into the reported payload previewmodules/malware/agents/narrative_agent.py:361-365payload_json, later read as trusted context by downstream agents -> indirect prompt-injection chain (tool result -> narrative -> next LLM call)Acceptance: playbook tool names validated against an allowlist; forensic files re-hashed locally after download and mismatch fails closed; script non-zero exit surfaced as an error to the agent; fuzz scrapers reject symlinks escaping the storage root; narrative text sanitized/classified before re-injection.