AstrBot Local Runtime Boundary Bypass Vulnerability via Hardlink Alias

A vulnerability exists in AstrBot versions through 4.25.5, specifically within the Filesystem Computer-Use Tool. The issue arises in the function _normalize_rw_path, located in astrbot/core/tools/computer_tools/fs.py. This vulnerability allows local users to bypass workspace restrictions by exploiting hardlink aliases, enabling unauthorized access to files outside the designated workspace boundary. The AstrBot process must have the appropriate permissions to the target files for this exploit to be successful.

Impact

Exploitation of this vulnerability allows a non-admin user to read or overwrite files outside their authorized workspace, potentially leading to unauthorized access or modification of sensitive data on the host system.

Reproduction

To reproduce this vulnerability, first ensure that AstrBot is running in local runtime mode with the setting 'provider_settings.computer_use_require_admin' set to true. The user role must be 'member'. Once these conditions are met, create a hardlink within the workspace that points to a file outside of it, ensuring both are on the same filesystem. Then, use AstrBot's filesystem tools to read from or write to the hardlinked file, which will actually affect the original file outside the workspace.