trace_b5930ce1ff4e431cbf238ca93fc70d44

findercompleted87excellent

StartedApr 13, 2026, 6:11 PM

EndedApr 13, 2026, 6:17 PM

Casecase_cc785128e8bb4799addf6b852b2c381a

Modelz-ai/glm-5.1

Context

Blind label

blind_d9424478ada9

Advisory

GHSA-m34q-h93w-vg5x • OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

Judge score

87 (excellent)

Rubric breakdown

Target Alignment

Source To Sink Reasoning

Impact And Exploitability

Evidence Quality

Overclaim Control

Prompt420 chars

This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Start at `extensions/openshell/src/config.ts`, trace `remoteWorkspaceDir` and `remoteAgentWorkspaceDir` through config resolution into mirror-mode sync behavior, and explain how insufficient root scoping can make remote cleanup or overwrite target an unintended directory.

OutputJSON

{
  "executiveSummary": "The OpenShell mirror mode plugin accepts arbitrary absolute remote workspace directory paths through its configuration, without verifying that they fall within a managed root (e.g., /sandbox or /agent). The `normalizeRemotePath` function in config.ts only checks that the path starts with `/`, meaning any absolute path such as `/`, `/etc`, `/usr`, or `/home` is accepted. These paths are subsequently used by `syncWorkspaceToRemote` in backend.ts as targets for destructive `find ... -exec rm -rf -- {} +` cleanup operations. An attacker or misconfigured deployment can set `remoteWorkspaceDir` or `remoteAgentWorkspaceDir` to an unintended directory, causing mirror sync to recursively delete all top-level contents of that directory on the remote sandbox before overwriting it with local workspace contents. This constitutes an insufficient root-scoping vulnerability that can lead to catastrophic data loss on the remote filesystem.",
  "reports": [
    {
      "title": "Insufficient root scoping of remoteWorkspaceDir and remoteAgentWorkspaceDir allows destructive mirror cleanup on unintended remote directories",
      "severity": "CRITICAL",
      "summary": "The `normalizeRemotePath` function in config.ts accepts any absolute path as a valid remote workspace directory, without verifying it falls within a managed root (e.g., /sandbox, /agent). These unconstrained paths are passed to `syncWorkspaceToRemote` in backend.ts, which runs `find \"$1\" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +` on them, recursively deleting all top-level contents. Setting `remoteWorkspaceDir` to `/` or any other unintended absolute path causes catastrophic data loss on the remote sandbox.",
      "rootCauseAnalysis": "The `normalizeRemotePath` function (config.ts, line ~103-109) performs only two checks: (1) non-empty trimmed value, and (2) starts with `/`. It does NOT verify that the path is scoped under a managed root like `/sandbox` or `/agent`. The resolved values flow directly into `ResolvedOpenShellPluginConfig.remoteWorkspaceDir` and `ResolvedOpenShellPluginConfig.remoteAgentWorkspaceDir`, which are consumed by `OpenShellSandboxBackendImpl.syncWorkspaceToRemote()` (backend.ts) as targets for destructive `rm -rf` shell commands executed on the remote sandbox.",
      "impact": "An operator or attacker who can influence the OpenShell plugin configuration can set `remoteWorkspaceDir` or `remoteAgentWorkspaceDir` to any absolute path (e.g., `/`, `/etc`, `/usr`, `/home/user`). When mirror mode executes a command, `syncWorkspaceToRemote` will delete all top-level contents of that path on the remote sandbox before uploading the local workspace. This causes irreversible data destruction on the remote filesystem. The impact is especially severe if the remote sandbox has shared or persistent storage, or if the path targets critical system directories.",
      "attackPath": "1. Attacker/developer configures OpenShell plugin with `remoteWorkspaceDir: \"/\"`

Tool calls

(16)

$cat /workspace/extensions/openshell/src/config.ts

import path from "node:path";
import { buildPluginConfigSchema, type OpenClawPluginConfigSchema } from "openclaw/plugin-sdk/core";
import { z } from "openclaw/plugin-sdk/zod";

export type OpenShellPluginConfig = {
  mode?: "mirror" | "remote";
  command?: string;
  gateway?: string;
  gatewayEndpoint?: string;
  from?: string;
  policy?: string;
  providers?: string[];

$cat /workspace/extensions/openshell/src/backend.ts

import fs from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import type {
  CreateSandboxBackendParams,
  OpenClawConfig,
  RemoteShellSandboxHandle,
  SandboxBackendCommandParams,
  SandboxBackendCommandResult,
  SandboxBackendFactory,
  SandboxBackendHandle,
  SandboxBackendManager,

$cat /workspace/extensions/openshell/src/mirror.ts

import fs from "node:fs/promises";
import path from "node:path";

export const DEFAULT_OPEN_SHELL_MIRROR_EXCLUDE_DIRS = ["hooks", "git-hooks", ".git"] as const;
const COPY_TREE_FS_CONCURRENCY = 16;

function createExcludeMatcher(excludeDirs?: readonly string[]) {
  const excluded = new Set((excludeDirs ?? []).map((d) => d.toLowerCase()));
  return (name: string) => excluded.has(name.toLowerCase());
}

function createConcurrencyLimiter(limit: number) {

$cat /workspace/extensions/openshell/src/fs-bridge.ts

import fsPromises from "node:fs/promises";
import path from "node:path";
import type {
  SandboxContext,
  SandboxFsBridge,
  SandboxFsStat,
  SandboxResolvedPath,
} from "openclaw/plugin-sdk/sandbox";
import { createWritableRenameTargetResolver } from "openclaw/plugin-sdk/sandbox";
import type { OpenShellSandboxBackend } from "./backend.js";
import { movePathWithCopyFallback } from "./mirror.js";

$find /workspace -path "*/openshell*" -name "*.test.*" -o -path "*/openshell*" -name "*.spec.*" | head -20exit 124

(no output)

$rg -n "remoteWorkspaceDir|remoteAgentWorkspaceDir" /workspace/extensions/openshell/src/ --type tsexit 124

(no output)

$find /workspace/extensions/openshell -name "*.test.*" -o -name "*.spec.*" 2>/dev/null

/workspace/extensions/openshell/src/backend.e2e.test.ts
/workspace/extensions/openshell/src/backend.test.ts
/workspace/extensions/openshell/src/mirror.test.ts
/workspace/extensions/openshell/src/openshell-core.test.ts

$rg -n "remoteWorkspaceDir" /workspace/extensions/openshell/src/exit 124

(no output)

$rg -n "remoteWorkspaceDir|remoteAgentWorkspaceDir" /workspace/extensions/openshell/src/exit 124

(no output)

$rg -n "remoteWorkspaceDir" /workspace/extensions/openshell/src/config.ts /workspace/extensions/openshell/src/backend.tsexit 124

(no output)

$grep -n "remoteWorkspaceDir" /workspace/extensions/openshell/src/config.ts

15:  remoteWorkspaceDir?: string;
30:  remoteWorkspaceDir: string;
78:  remoteWorkspaceDir: nonEmptyTrimmedString(
79:    "remoteWorkspaceDir must be a non-empty string",
150:      remoteWorkspaceDir: DEFAULT_REMOTE_WORKSPACE_DIR,
173:    remoteWorkspaceDir: normalizeRemotePath(cfg.remoteWorkspaceDir, DEFAULT_REMOTE_WORKSPACE_DIR),

$grep -n "remoteWorkspaceDir|remoteAgentWorkspaceDir" /workspace/extensions/openshell/src/backend.tsexit 1

(no output)

$grep -n "remoteWorkspace" /workspace/extensions/openshell/src/backend.ts

114:    remoteWorkspaceDir: params.pluginConfig.remoteWorkspaceDir,
122:    workdir: params.pluginConfig.remoteWorkspaceDir,
150:    remoteWorkspaceDir: params.pluginConfig.remoteWorkspaceDir,
166:      remoteWorkspaceDir: string;
177:      workdir: this.params.remoteWorkspaceDir,
182:      remoteWorkspaceDir: this.params.remoteWorkspaceDir,
230:      workdir: params.workdir ?? this.params.remoteWorkspaceDir,
396:      args: [this.params.remoteWorkspaceDir],
400:      this.params.remoteWorkspaceDir,
430:          this.params.remoteWorkspaceDir,

$grep -n "remoteAgentWorkspace" /workspace/extensions/openshell/src/backend.ts

115:    remoteAgentWorkspaceDir: params.pluginConfig.remoteAgentWorkspaceDir,
151:    remoteAgentWorkspaceDir: params.pluginConfig.remoteAgentWorkspaceDir,
167:      remoteAgentWorkspaceDir: string;
183:      remoteAgentWorkspaceDir: this.params.remoteAgentWorkspaceDir,
410:        args: [this.params.remoteAgentWorkspaceDir],
414:        this.params.remoteAgentWorkspaceDir,

$cat /workspace/extensions/openshell/src/backend.test.ts

import { afterEach, describe, expect, it } from "vitest";
import { buildOpenShellSshExecEnv } from "./backend.js";

describe("openshell backend env", () => {
  const originalEnv = { ...process.env };

  afterEach(() => {
    for (const key of Object.keys(process.env)) {
      if (!(key in originalEnv)) {
        delete process.env[key];
      }
    }

$cat /workspace/extensions/openshell/src/openshell-core.test.ts

import fsSync from "node:fs";
import fs from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import { createSandboxTestContext } from "openclaw/plugin-sdk/testing";
import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
import type { OpenShellSandboxBackend } from "./backend.js";
import {
  buildExecRemoteCommand,
  buildOpenShellBaseArgv,
  resolveOpenShellCommand,
  setBundledOpenShellCommandResolverForTest,

Step spans

(13)