| Titel | HKUDS nanobot 0.2.1 Sensitive Information Exposure via Login Shell Startup Files (CWE-200) |
|---|
| Beschreibung | # Technical Details
A secret disclosure vulnerability exists in the `ExecTool._prepare_command` method in `nanobot/agent/tools/shell.py` of nanobot.
The application fails to keep `exec` subprocesses isolated from login-shell startup files. When the caller omits `login`, nanobot defaults it to `True`, launches `bash -l -c` or `zsh -l -c`, and forwards `HOME` into the child environment. This causes `~/.bash_profile` or similar startup files to re-export secrets that the reduced environment was supposed to exclude, making them readable through simple commands like `printenv LOGIN_SECRET`.
# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._prepare_command() / ExecTool._spawn()
Why: `_prepare_command()` silently promotes `login=None` to `True`, `_spawn()` adds the `-l` flag for login shells, and `_build_env()` preserves `HOME`, allowing the child shell to source startup files and reintroduce secrets into the process environment.
# Reproduction
1. On nanobot 0.2.1, create a temporary `HOME` containing `.bash_profile` that exports a secret such as `LOGIN_SECRET=NB_LOGIN_CANARY`.
2. Trigger a normal `exec` tool call with `printenv LOGIN_SECRET` through the CLI or provided end-to-end PoC without setting `login=false`.
3. Observe that the returned tool output contains the canary secret, while a control case with `login=false` does not leak it.
# Impact
- Users who can trigger ordinary `exec` calls can recover secrets exported by shell startup files, including API keys or internal tokens.
- The intended reduced-environment security boundary of the `exec` tool is defeated on Unix-like systems using login shells. |
|---|
| Quelle | ⚠️ https://gist.github.com/YLChen-007/b25f3f185478e0b2cd0e727bf5c5ed9b |
|---|
| Benutzer | Eric-c (UID 96848) |
|---|
| Einreichung | 22.06.2026 04:22 (vor 2 Monaten) |
|---|
| Moderieren | 07.08.2026 14:08 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 386999 [HKUDS nanobot bis 0.2.1 Login-shell Environment shell.py ExecTool._prepare_command Information Disclosure] |
|---|
| Punkte | 20 |
|---|