| Titel | NousResearch hermes-agent 2026.6.5 Incorrect Authorization (CWE-863) |
|---|
| Beschreibung | # Technical Details
An authorization bypass exists in the slash-command handling of `gateway/run.py` in hermes-agent.
The application applies `_check_slash_access()` authorization only to commands that resolve through `is_gateway_known_command(canonical)`, but config-backed `quick_commands` are dispatched on a separate code path without any access-control check. This allows an authenticated allowlisted non-admin messaging user to invoke admin-only quick commands, including `type: exec` commands that run shell commands in the gateway process.
# Vulnerable Code
File: gateway/run.py
Method: _handle_message (slash command handler)
Why: The handler checks `_check_slash_access(source, canonical)` only when `is_gateway_known_command(canonical)` is true, then later dispatches `quick_commands` with `asyncio.create_subprocess_shell(...)` without re-running the authorization check.
# Reproduction
1. Configure hermes-agent with `allow_admin_from: ["111"]`, `user_allowed_commands: []`, and a quick command like `quick_commands.limits = {type: exec, command: "printf quick-command-bypass-confirmed"}`.
2. Authenticate as a non-admin allowlisted gateway user (user_id=999).
3. Send `/limits` to the gateway.
4. Observe the command executes and returns `quick-command-bypass-confirmed`, while the registered command `/stop` correctly returns an admin-only denial.
# Impact
- Non-admin gateway users can bypass admin-only slash-command restrictions.
- When quick commands use `type: exec`, attackers can trigger shell command execution in the gateway process context.
- Can expose sensitive operational data, modify system state, or disrupt service. |
|---|
| Quelle | ⚠️ https://gist.github.com/YLChen-007/f0036aa1c410b70f5e41272947180645 |
|---|
| Benutzer | Eric-y (UID 95889) |
|---|
| Einreichung | 12.06.2026 11:40 (vor 2 Monaten) |
|---|
| Moderieren | 04.08.2026 09:35 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 385783 [NousResearch hermes-agent bis 2026.6.5 Quick Command gateway/run.py _check_slash_access erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|