Skip to content

KC-1505, KC-1506: Fix Service Mode filesystem bypasses - #2441

Open
amangalampalli-ks wants to merge 5 commits into
fix/service-mode-fileIO-bypassfrom
fix/service-mode-fileIO-bypass-int
Open

amangalampalli-ks wants to merge 5 commits into
fix/service-mode-fileIO-bypassfrom
fix/service-mode-fileIO-bypass-int

Conversation

@amangalampalli-ks

@amangalampalli-ks amangalampalli-ks commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Close Service Mode host-filesystem access bypasses while preserving supported FILEDATA imports and protecting sensitive files.

Changes

  • Block escaped file-path and attachment arguments, Automator certificate file access, and Automator file/base64/environment expansions.
  • Align Service Mode validation with command parsing, including Windows output-path normalization.
  • Quote FILEDATA paths safely, including paths with spaces or apostrophes.
  • Harden permissions through symlinked parent directories while refusing linked final files.

@amangalampalli-ks amangalampalli-ks self-assigned this Oct 14, 2026
@amangalampalli-ks
amangalampalli-ks force-pushed the fix/service-mode-fileIO-bypass-int branch from c9d049d to 874aa19 Compare October 16, 2026 05:08
@amangalampalli-ks
amangalampalli-ks marked this pull request as ready for review October 16, 2026 05:43

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant