| Título | louisho5 picobot 0.2.0 Incomplete List of Disallowed Inputs (CWE-184) |
|---|
| Descripción | # Technical Details
A dangerous-program blacklist bypass vulnerability exists in the `[ExecTool.Execute]` method in `internal/agent/tools/exec.go` of picobot.
The application fails to recursively inspect wrapped command dispatch. The blacklist only checks `argv[0]`, so a blocked payload such as `rm` can be hidden behind `/usr/bin/env bash -lc`. The command array `["/usr/bin/env","bash","-lc","rm /abs/path/to/marker.txt"]` passes validation and reaches `exec.CommandContext`, which launches `env`, dispatches `bash`, and executes the prohibited command.
# Vulnerable Code
File: `internal/agent/tools/exec.go`
Method: `ExecTool.Execute`
Why: The safety policy inspects only the top-level executable and not nested shell-wrapper execution chains, making the blacklist incomplete and bypassable.
# Reproduction
1. Run the supplied harness with a local provider that returns an `exec` tool call containing `["/usr/bin/env","bash","-lc","rm /abs/path/to/marker.txt"]`.
2. Invoke the normal `picobot agent -m` CLI path so the provider tool call is executed.
3. Confirm the marker file is deleted, while the direct control payload `["rm","/abs/path/to/marker.txt"]` is rejected.
# Impact
- Bypasses Picobot’s intended dangerous-program restrictions for the `exec` tool.
- Enables destructive command execution through wrapper-based dispatch under the Picobot process account. |
|---|
| Fuente | ⚠️ https://github.com/louisho5/picobot/issues/43 |
|---|
| Usuario | Eric-h (UID 97582) |
|---|
| Sumisión | 2026-06-11 11:27 (hace 1 mes) |
|---|
| Moderación | 2026-07-13 23:12 (1 month later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 378163 [louisho5 picobot hasta 0.2.0 exec Tool exec.go ExecTool.Execute escalada de privilegios] |
|---|
| Puntos | 0 |
|---|