| Titel | cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285) |
|---|
| Beschreibung | # Technical Details
An Improper Authorization vulnerability exists in Mercury's delegated sub-agent flow. In `src/core/sub-agent.ts`, the delegated worker unconditionally enables `autoApproveAll` and a broad temporary filesystem scope before entering its tool loop. In `src/capabilities/permissions.ts`, `checkShellCommand()` immediately approves shell execution whenever `autoApproveAll` is set, skipping the normal prompt gate entirely. Since `delegate_task` spawns the sub-agent using the same capability registry and preserves the caller's channel context, an attacker can route a normally approval-gated shell command through `delegate_task` to achieve silent execution via `run_command` in `src/capabilities/shell/run-command.ts`.
# Vulnerable Code
File: src/core/sub-agent.ts (lines 137-145)
Method: SubAgent.run()
Why: The delegated worker unconditionally enables `autoApproveAll` and broad temporary filesystem scope before executing tools.
File: src/capabilities/permissions.ts (lines 458-462)
Method: PermissionManager.checkShellCommand()
Why: `checkShellCommand()` immediately approves shell execution whenever `autoApproveAll` is set, skipping the normal prompt gate.
File: src/capabilities/shell/run-command.ts (lines 97-108)
Method: run_command tool handler
Why: `run_command` trusts the result of `checkShellCommand()` and then executes the attacker-influenced command in a real shell.
# Reproduction
1. Authenticate to Mercury web dashboard.
2. Send a chat prompt causing the model to invoke `delegate_task` with a shell command payload.
3. Observe the delegated sub-agent executes `run_command` without triggering any `permission_request` event.
4. Confirm the canary file is written with the expected content.
5. Verify the control path (direct `run_command`) shows `permissionRequestCount: 1` and creates no file.
# Impact
- Approval-bypass leading to arbitrary command execution in the Mercury runtime context.
- Attacker can run arbitrary shell commands with Mercury's filesystem, secrets, and host privileges.
- Can expose `.env` files, `~/.mercury` state, source code, API tokens, and local Git credentials. |
|---|
| Quelle | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/75 |
|---|
| Benutzer | ChenMarry (UID 99089) |
|---|
| Einreichung | 18.06.2026 09:37 (vor 2 Monaten) |
|---|
| Moderieren | 05.08.2026 21:42 (2 months later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 386381 [cosmicstack-labs mercury-agent bis 1.1.12 delegate_task Tool src/core/sub-agent.ts SubAgent.run erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|