Fix: OpenHarness /resume & /summary remote command data leakage

[security] fix(ohmo): keep session restore local-only remotely #276 Vulnerability Overview This vulnerability affects the and commands in Slack's OpenHarness project. While these commands are designed to restore and summarize session content, they were incorrectly configured to be remotely invocable in shared ohmo channels, creating a risk of cross-session data leakage. Impact Scope Remote Session Leakage: Attackers can access other users' session snapshots and summaries by remotely invoking the and commands. Cross-Session Data Leakage: In shared ohmo channels, attackers can load other users' session snapshots to extract sensitive information. Remediation Localize Commands: Default and to local invocation only, allowing execution solely in the local environment. Explicit Remote Invocation: Retain the option, allowing administrators to explicitly enable remote invocation if needed. Code Modifications: - Modify to set to and to for the and commands. - Update test cases to ensure the local invocation behavior is correct. POC Code Security Impact CVSS Score: 3.1 (N/A) Attack Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attacker Requirements: The attacker must be an authenticated remote gateway sender; no victim interaction is required. Impact: Affects confidentiality only, potentially crossing expected per-sender session boundaries. Security Reproduction Steps 1. Save Alice's snapshot with session key , tagging the text with . 2. Save Bob's snapshot with session key . 3. Confirm that returns distinct session keys for Alice and Bob. 4. In the vulnerable code, verify that and are remotely invocable. 5. Invoke the remote endpoint for Bob and observe that Alice's session ID/summary appears in the list. 6. Invoke Bob's remote followed by , and observe that Alice's tagged text appears in Bob's results. Expected Vulnerable Behavior File Changes : Set and to local invocation. : Add registration assertions for session/transport commands. : Add regression tests denying remote and . Maintainer Impact and remain available in the local OpenHarness UI. Remote callers receive the same "local-only" rejection messages used for other sensitive commands. Administrators who wish to expose these commands can opt-in via the existing mechanism. This PR does not change the disk snapshot format or the core session storage API. Rationale The conservative boundary is to keep session restoration and session inspection as local-only operations on remote channels. This aligns with the handling of other existing sensitive commands that could leak local state or compromise local control plane behavior. Change Types Security Fix Regression Test Documentation Update Refactoring Dependency Update Test Plan Local Execution: Observed Results: - Focused regression subset: 3 passed, 4 warnings - Triggered commands/gateway suite: 126 passed, 11 warnings - Compilation: Passed - : Passed - : Passed Disclosure Statement This PR intentionally restricts scope to remote gateway confidentiality issues. It does not claim unauthenticated access or remote code execution. The threat model assumes an authenticated remote gateway sender who can invoke remote slash commands within a shared ohmo workspace.

Goal Reached Thanks to every supporter — we hit 100%!

Fix: OpenHarness /resume & /summary remote command data leakage

More from this source