# Export/Extract Tool Directory Parameter Redirected to a Credential Directory

- **Severity:** Critical
- **Signature ID:** `d78778c6-9c31-4c12-bd0d-30cabe89014a`
- **CVEs:** CVE-2026-43901
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM08 (Vector and Embedding Weaknesses)

## Summary

An AI agent that can export, merge, or extract files (like a network-capture tool saving captured objects) can be manipulated into pointing its 'save to this folder' setting at a credentials directory such as ~/.ssh or ~/.aws. No path-traversal trick is needed - the folder parameter is a normal, documented tool option; the attack just sets it to a sensitive location so the export drops attacker-controlled files there.

## How the attack works

An attacker crafts malicious content that the agent will process, such as a network capture file containing a hidden instruction (prompt injection) and a file named something like 'authorized_keys'. When the AI model processes this content through its export/extract tool, the injected instruction manipulates it into calling the export function with the destination directory set to a credential folder like ~/.ssh instead of the normal output location. The export tool then writes the attacker-named file directly into that folder because the tool itself has no restriction on which directories it's allowed to write to. The result is a file such as a rogue SSH key landing inside the user's real .ssh directory, ready to be used for further access.

## Why it matters

An attacker can plant files inside SSH, AWS, GPG, Docker, or Kubernetes credential directories - for example dropping a rogue authorized_keys file - which can lead to unauthorized remote access or credential theft without any traditional path-traversal exploit.

## What you can do

- Restrict any export/merge/extract tool exposed to an AI agent to a fixed, allow-listed output directory and reject requests to write elsewhere.
- Treat destination-directory parameters (dest_dir, output_dir, export_dir, extract_dir, save_dir) as untrusted input and validate them against a strict allowlist rather than trusting the tool's default.
- Never let an agent process untrusted file content (like pcaps or archives) that could contain hidden instructions without isolating or sanitizing that content first.
- Monitor and alert on any tool call whose destination directory matches known credential paths (~/.ssh, ~/.aws, ~/.gnupg, ~/.docker, ~/.kube), while excluding legitimate backup/management tools whose documented purpose is to touch those paths.

## Known benign look-alikes

- A destination-directory argument pointed at the tool's own configured output/working directory (Downloads, /tmp, a project workspace), even when it is an absolute path — this rule only fires on the specific credential directories listed (.ssh, .aws, .gnupg, .docker, .kube)
- A legitimate SSH/cloud-credential management skill whose documented purpose is to read or back up its own ~/.ssh or ~/.aws directory — should be reviewed for context since the parameter shape is identical to the attack

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02146
- https://github.com/bx33661/Wireshark-MCP/security/advisories/GHSA-3r68-x3xc-rxpg
- https://nvd.nist.gov/vuln/detail/CVE-2026-43901

---
Source: https://www.netzilo.com/threats/atr-export-extract-tool-directory-parameter-redirected-to-a-cred