Advisoriesby IbisProtected environment values can be disclosed through declarative workflow control flow
Summary
Microsoft Agent Framework's .NET declarative workflow engine can disclose protected environment values through control-flow decisions. In the reported affected version, an untrusted workflow can branch on a protected value, assign an ordinary literal in the selected branch, and emit that literal without triggering the checks that reject direct disclosure of sensitive values.
This affects hosts that execute less-trusted workflow definitions, expose protected values in the workflow Env scope, and provide an output channel observable by the workflow author.
Details
The package tracks sensitivity metadata for workflow values and rejects sensitive values at output boundaries. However, ConditionGroupExecutor.ExecuteAsync evaluates a condition and branches on EvaluationResult<bool>.Value without first checking that result's sensitivity. Assigning an otherwise non-sensitive literal inside that branch does not inherit the sensitivity of the branch condition.
Consequently, a branch-selected value can reveal information about a protected input while appearing non-sensitive to downstream output checks. Repeated secret-dependent decisions can disclose more than a single Boolean result. The report demonstrates full recovery of a fabricated secret and capture of a reconstructed value in an HTTP request.
The related Foreach path also permits implicit information flow...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Microsoft.Agents.AI.Workflows.Declarative NuGet | < 1.26.0 | 1.26.0 |
Details and references
### Summary Microsoft Agent Framework's .NET declarative workflow engine can disclose protected environment values through control-flow decisions. In the reported affected version, an untrusted workflow can branch on a protected value, assign an ordinary literal in the selected branch, and emit that literal without triggering the checks that reject direct disclosure of sensitive values. This affects hosts that execute less-trusted workflow definitions, expose protected values in the workflow Env scope, and provide an output channel observable by the workflow author. ### Details The package tracks sensitivity metadata for workflow values and rejects sensitive values at output boundaries. However, ConditionGroupExecutor.ExecuteAsync evaluates a condition and branches on EvaluationResult<bool>.Value without first checking that result's sensitivity. Assigning an otherwise non-sensitive literal inside that branch does not inherit the sensitivity of the branch condition. Consequently, a branch-selected value can reveal information about a protected input while appearing non-sensitive to downstream output checks. Repeated secret-dependent decisions can disclose more than a single Boolean result. The report demonstrates full recovery of a fabricated secret and capture of a reconstructed value in an HTTP request. The related Foreach path also permits implicit information flow through an iteration count or index when loop items depend on protected values. The candidate fix rejects sensitive loop inputs as well as sensitive conditions; protecting only the loop value variable is insufficient to prevent iteration-count leakage. ### Proof of concept Use only a local test harness with fabricated configuration and captured outputs; do not connect to external services. 1. Configure a host with AllowedEnvironmentVariables containing DEMO_FLAG and an in-memory configuration value DEMO_FLAG = "enabled". 2. Execute a test workflow containing a ConditionGroup whose condition is =Env.DEMO_FLAG = "enabled". Have the matching branch assign the ordinary literal "matched" to Local.Result and the else branch assign "not matched". 3. After the branch, use SendActivity to emit Local.Result to the local harness. Run the same test with the fabricated setting changed to "disabled". 4. As a control, attempt to emit Env.DEMO_FLAG directly. Observed behavior in the reported affected version: the direct control is rejected, but the branch-selected ordinary literal is emitted and distinguishes the two protected inputs. Expected behavior with the candidate fix: a sensitive condition is rejected before selecting either branch; a condition based only on non-sensitive values continues to work. This is a sanitized illustration of the reported branch channel, not a reproduction against a live service or a full secret-extraction payload. ### Impact A less-trusted workflow author can learn protected values that the host intentionally exposed through the workflow Env scope. Required prerequisites are host execution of the author's workflow, access by that workflow to the protected configuration, and an observable output channel such as returned activity text or an enabled outbound action. The report demonstrates disclosure using fabricated values and in-process capture. It does not establish disclosure of arbitrary process environment variables, cross-tenant access, or access to configuration that the host did not expose.