| Título | nearai IronClaw 0.29.1 Improper Authorization (CWE-285) |
|---|
| Descripción | # Technical Details
A Shell Approval Bypass via `sort --compress-program` exists in the low-risk allowlist in `src/tools/builtin/shell.rs` of IronClaw.
The application classifies `sort` as a low-risk command in the `LOW_RISK_PATTERNS` table without considering that GNU `sort` supports `--compress-program`, which delegates execution to an attacker-chosen external helper. When `shell` is configured as `AlwaysAllow`, a command beginning with `sort --compress-program=<helper>` is classified as `RiskLevel::Low`, maps to `ApprovalRequirement::UnlessAutoApproved`, and executes without a fresh approval prompt. The external helper program runs under the IronClaw process context.
# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: LOW_RISK_PATTERNS table includes "sort" as read-only; classify_command_risk() returns Low for sort-prefixed segments without inspecting `--compress-program`
Why: `sort` is trusted as a safe/read-only binary, but its `--compress-program` flag allows arbitrary external helper execution that the classifier does not detect.
# Reproduction
1. Deploy IronClaw with `shell=AlwaysAllow` and GNU `sort` available on the host.
2. Send a shell command: `sort --compress-program=/path/to/helper.sh /dev/null`.
3. Observe that the external helper script executes and creates filesystem canary evidence.
4. Confirm the command was classified as `Low` risk and auto-approved.
# Impact
- Approval bypass enabling host- or container-context command execution through a helper program delegated by GNU `sort`.
- An authenticated user or prompt-influenced LLM action can spawn attacker-selected external programs.
- Defeats the explicit-approval safety boundary for commands that appear benign by prefix. |
|---|
| Fuente | ⚠️ https://github.com/nearai/ironclaw/issues/4862 |
|---|
| Usuario | Erichen-apple (UID 99087) |
|---|
| Sumisión | 2026-06-18 08:37 (hace 2 meses) |
|---|
| Moderación | 2026-08-05 18:45 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 386265 [nearai ironclaw hasta 0.29.1 shell.rs classify_command_risk escalada de privilegios] |
|---|
| Puntos | 0 |
|---|