| Título | TinyAGI tinyagi 0.0.20 Missing Authorization (CWE-862) |
|---|
| Descripción | # Technical Details
A Missing Authorization vulnerability exists in TinyAGI's Anthropic execution path. The public `POST /api/message` endpoint in `packages/server/src/routes/messages.ts` accepts unauthenticated attacker input and enqueues it via `enqueueMessage()`. The queue processor in `packages/main/src/index.ts` then passes the message into `invokeAgent()` without any local permission gate. The Claude provider adapter in `packages/core/src/adapters/claude.ts` initializes the CLI subprocess arguments with `--dangerously-skip-permissions` by default before appending the attacker-controlled prompt with `-p <message>`. This flag disables Claude's provider-side permission approval barrier for tool usage. The source-to-sink chain is: `POST /api/message` → `enqueueMessage()` → SQLite queue → `processMessage()` → `invokeAgent()` → `claude --dangerously-skip-permissions -p <message>`.
# Vulnerable Code
File: packages/server/src/routes/messages.ts (lines 7-16)
Method: POST /api/message handler
Why: Public unauthenticated HTTP entrypoint that accepts attacker-controlled `message` content.
File: packages/core/src/adapters/claude.ts (lines 27-43)
Method: Claude adapter invoke()
Why: Initializes the CLI argument list with `--dangerously-skip-permissions` before appending the attacker-controlled prompt.
File: packages/main/src/index.ts (lines 98-109)
Method: processMessage()
Why: Forwards the queued message into `invokeAgent(...)`, which drives the provider adapter on behalf of the external caller.
# Reproduction
1. Start TinyAGI daemon with a Claude provider configured.
2. Send `POST /api/message` with attacker-controlled prompt content via a PATH shim that captures subprocess argv.
3. Inspect captured sink arguments — confirm `--dangerously-skip-permissions` is present.
4. Run matched control: strip only `--dangerously-skip-permissions` flag, confirm control `captured-control.json` lacks the flag.
5. Observe that the same HTTP entrypoint and queue path are preserved in both cases.
# Impact
- Network-reachable permission-bypass in the default Anthropic execution path.
- Attacker-controlled prompts reach Claude in pre-approved mode, skipping provider-side permission approvals.
- Weakens the last safety barrier for high-risk tool use (local files, command execution, plugins).
- Exposes host running TinyAGI, agent workspace, project files, cached secrets, and reachable systems. |
|---|
| Fuente | ⚠️ https://github.com/TinyAGI/tinyagi/issues/284 |
|---|
| Usuario | JondaChen (UID 99096) |
|---|
| Sumisión | 2026-06-18 10:48 (hace 2 meses) |
|---|
| Moderación | 2026-08-05 22:20 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 386403 [TinyAGI 0.0.20 Message API Endpoint index.ts processMessage escalada de privilegios] |
|---|
| Puntos | 20 |
|---|