MoAI-ADK Symlink Follow Leading to Out-of-Project File Overwrite (CWE-59)

Vulnerability Overview MoAI-ADK: Template deployment follows a planted symbolic link and overwrites files outside the project Reporter: HainD (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology, github.com/HainD03 Project: modu-ai/moai-adk, MoAI-ADK, the moai Go CLI template deployer Affected Version: v3.1.2 Vulnerability Type: CWE-59 Improper Link Resolution Before File Access, CWE-22-adjacent out-of-project file write Summary deploys an embedded template to the project directory using a routine that writes temporary files and then renames them. For each file, it writes and then renames the temporary file to the target. This routine calls on the staging path without checking if the path is a regular file, and the path validation step only checks the embedded template name, never checking the staging path. If the staging path already contains a symbolic link, such as redirecting the write, when the user selects the Claude tool to run , the deployment follows the symbolic link and truncates and overwrites a file outside the project, then renames the symbolic link to the target. The bytes written are MoAI's own rendered , not content chosen by the attacker. The result is an out-of-project file overwrite, which corrupts the target file and replaces it with fixed template content. This is local, requiring the victim to initialize an attacker-supplied checkout on a POSIX filesystem. Root Cause The flaw is a combination of three facts: the staging path is derived via string concatenation, the validation step never examines that path, and the write follows symbolic links. 1. The staging path is and the write follows symbolic links - constructs the temporary path by appending a fixed suffix, writes to it, and renames it. - opens the path with , lacking . On POSIX, opening a path whose final component is a symbolic link follows the link and operates on the target. If already exists as a symbolic link, the write truncates and overwrites whatever the symbolic link points to. There is no and no symlink rejection prior to the write. 2. Existing file guard checks the target, not the staging path - The deployment loop guards against overwriting existing targets, but it s , not . - In a fresh checkout, the attacker only places the symlink and leaves non-existent. returns an error, so the guard does not trigger, and the write proceeds via . 3. Path validation is lexical and never examines the staging path - The argument is the embedded template (the name within MoAI's own template tree), not the on-disk staging path in the user's checkout. The function rejects and absolute names, but it never calls or . Symbolic links in the staging path are outside the function's checks. 4. Deployment of templates reaches this write during normal - constructs a deployer with and runs the deployment. The embedded file exists and is deployed when the Claude tool is selected. The deployer strips , so the target is , and the staging path is . Impact Scope Shared or Home Directory Targets: Any user-writable file is a valid target, such as shell configuration files, profile files, or other project files. External files are corrupted and replaced. Fresh Checkouts: The attack applies to fresh checkouts because the target does not exist, so the existing file guard does not trigger. Content is Not Attacker-Selected: The bytes written are MoAI's own rendered template, so this is a file integrity and availability issue, not arbitrary content write. Not established: Disclosure of overwriting files, arbitrary attacker-controlled content, code execution, privilege escalation, and any Windows behavior. The attack requires a POSIX filesystem, the victim running inside an attacker-provided checkout, and selecting Claude during . Remediation Short-term Reject staging paths that are symbolic links and open them without following the link. Medium-term Resolve the real target directory before writing and confirm it is within the project root, so that symbolic link parent directories cannot redirect the write. Defense in depth: reject any staging or target path whose parent directory resolves outside the project root, and add regression tests planting a symbolic link at and asserting that deployment rejects and writes outside the project. References Project: modu-ai/moai-adk, SECURITY.md routes to private GitHub Security Advisories Fixed Sources: , , Go os.WriteFile Documentation CWE-59 Improper Link Resolution Before File Access, CWE-22 Improper Limitation of a Pathname to a Restricted Directory No public advisory or CVE targeting this at time of writing

Goal Reached Thanks to every supporter — we hit 100%!

MoAI-ADK Symlink Follow Leading to Out-of-Project File Overwrite (CWE-59)

More from this source