Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

Summary

## Summary

The `FileSessionManager` defaults to storing session data in `/tmp/strands/sessions/` (a world-writable directory) using predictable file paths and a write pattern (`open(path + ".tmp", "w")` → `os.replace()`) that follows symbolic links. A local attacker can exploit this to overwrite arbitrary files or inject malicious session data for persistent prompt injection.

## Vulnerability Details

**Component:** `strands-py/src/strands/session/file_session_manager.py`

**Root Cause:** 1. Default storage directory is `tempfile.gettempdir() + "/strands/sessions/"` (line 58) — resolves to `/tmp/strands/sessions/` on Linux/macOS 2. The `_write_file()` method (lines 116-123) writes to a predictable `.tmp` path without symlink protection: ```python tmp = f"{path}.tmp" with open(tmp, "w", encoding="utf-8", newline="\n") as f: json.dump(data, f, indent=2, ensure_ascii=False) os.replace(tmp, path) ``` 3. `open()` follows symlinks — a pre-placed symlink at the `.tmp` path causes writes to an arbitrary target file 4. No integrity verification (HMAC/signature) on session files — tampered data is loaded as-is

## Attack Vectors

### 1. Arbitrary File Overwrite (Local Privilege Escalation) 1. Attacker pre-creates `/tmp/strands/sessions/session_<id>/` (or monitors for new directories via inotify) 2. Attacker creates a symlink: `session.json.tmp` → `/home/victim/.bashrc` (or any writable file) 3. Victim application writes session data → follows symlink → overwrites target file with JSON content 4. Attacker achieves code execution on next shell login (or targets `.ssh/authorized_keys`, cron files, etc.)

### 2. Persistent Prompt Injection via Session Tampering 1. Attacker writes crafted message files into the session directory 2. Victim application restores the session → loads attacker-controlled conversation history 3. Injected messages instruct the agent to execute attacker commands on every future interaction 4. No integrity check prevents this — the SDK trusts all session files at face value

## Impact

- **Arbitrary file overwrite** — local attacker can write attacker-controlled content to any file writable by the victim process - **Local privilege escalation** — via overwriting shell configs, SSH keys, cron jobs, or systemd user services - **Persistent agent compromise** — via session data injection, the agent follows attacker instructions indefinitely

## Reproduction

```python import os, json, tempfile, shutil

# Setup: simulate the vulnerable write pattern session_dir = "/tmp/strands/sessions/session_test/" os.makedirs(session_dir, exist_ok=True)

# Attacker: create symlink at the .tmp write path target_file = "/tmp/symlink_attack_proof.txt" with open(target_file, "w") as f: f.write("ORIGINAL - should not be overwritten\n")

symlink_path = os.path.join(session_dir, "session.json.tmp") if os.path.exists(symlink_path): os.unlink(symlink_path) os.symlink(target_file, symlink_path)

# Victim: FileSessionManager._write_file() equivalent with open(symlink_path, "w", encoding="utf-8", newline="\n") as f: json.dump({"session_id": "test", "injected": True}, f, indent=2)

# Verify: target file overwritten with open(target_file) as f: print(f"Target file content: {f.read()}") # Output: {"session_id": "test", "injected": true}

# Cleanup os.unlink(symlink_path) os.unlink(target_file) shutil.rmtree(session_dir) ```

## Suggested Fix

1. **Use a user-private default directory** — `~/.strands/sessions/` or `$XDG_DATA_HOME/strands/sessions/` instead of `/tmp/` 2. **Use `os.open()` with `O_NOFOLLOW | O_CREAT | O_WRONLY`** — refuses to follow symlinks 3. **Use `tempfile.mkstemp()`** for atomic writes instead of predictable `.tmp` suffix 4. **Verify directory ownership** matches the current user before writing 5. **Add optional integrity verification** (HMAC) on session files to detect tampering