| Titel | NanoCoAI NanoClaw 2.0.64 Improper Authorization (CWE-285) |
|---|
| Beschreibung | # Technical Details
An approval smuggling vulnerability exists in the `add_mcp_server` self-modification flow in NanoClaw. The container agent's built-in `add_mcp_server` tool accepts `name`, `command`, `args`, and `env`, forwarding all four fields into the outbound system action. On the host side, `handleAddMcpServer()` in `src/modules/self-mod/request.ts` stores the full payload in the approval request, but the human-visible approval question only renders `serverName` and `command`, hiding `args` and `env` from the approver. After approval, `applyAddMcpServer()` in `src/modules/self-mod/apply.ts` persists the hidden fields unchanged into `container_configs.mcp_servers`, and `materializeContainerJson()` writes them into `groups/<folder>/container.json` for later runtime use.
# Vulnerable Code
File: container/agent-runner/src/mcp-tools/self-mod.ts (Lines 83-116)
Method: Built-in `add_mcp_server` tool
Why: The tool forwards all four fields (`name`, `command`, `args`, `env`) into the outbound system action without restricting which fields the approver sees.
File: src/modules/self-mod/request.ts (Lines 78-90)
Method: `handleAddMcpServer()`
Why: The approval payload stores the full execution context but the question only renders `Agent "${agentGroup.name}" is attempting to add a new MCP server:\n${serverName} (${command})`, hiding `args` and `env`.
File: src/modules/self-mod/apply.ts (Lines 98-105)
Method: `applyAddMcpServer()`
Why: After approval, the host persists all fields including hidden `args` and `env` into `container_configs.mcp_servers` without revalidating or re-rendering for the approver.
# Reproduction
1. Set up a NanoClaw deployment at version <= 2.0.64 with the self-modification approval flow enabled.
2. Submit a benign-looking `add_mcp_server` request with `name = "safe"`, `command = "node"`.
3. In the same request, include hidden `args = ["-e", "console.log(\"hidden\")"]` and `env = {"NODE_OPTIONS": "--require /tmp/payload.js"}`.
4. Observe the approval card shows only `Agent "Agent" is attempting to add a new MCP server:\nsafe (node)` — no mention of the hidden `args` or `env`.
5. Approve the request and inspect the generated `groups/variant-agent-smuggling/container.json` — confirm the hidden `args` and `env` are persisted and materialized into the runtime configuration.
6. Run the control case with the same approval text but no hidden fields — confirm no hidden context is persisted, proving the defect is in the unrendered fields.
# Impact
- An administrator can unknowingly authorize broader command execution context than what the approval card shows.
- Hidden command-line arguments and environment variables can introduce preloaded code or altered execution behavior.
- A one-time approval can be converted into a durable runtime configuration change.
- Affects the host-side approval boundary, per-agent runtime configuration integrity, and downstream resources reachable by the MCP server. |
|---|
| Quelle | ⚠️ https://github.com/nanocoai/nanoclaw/issues/2762 |
|---|
| Benutzer | Erichen-x (UID 99082) |
|---|
| Einreichung | 18.06.2026 04:39 (vor 1 Monat) |
|---|
| Moderieren | 25.07.2026 13:08 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 383075 [nanocoai NanoClaw bis 2.0.64 add_mcp_server request.ts handleAddMcpServer erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|