| Titre | AstrBotDevs AstrBot 4.25.5 Incorrect Authorization (CWE-863) |
|---|
| Description | # Technical Details
A Persona Tools Policy Bypass exists in the `build_main_agent()` method in `astrbot/core/astr_main_agent.py` of AstrBot.
The application fails to re-apply persona-level tool restrictions after late-append helper functions add built-in tools. A persona configured with `tools=[]` correctly yields an empty tool set after initial persona filtering, but subsequent calls to `_apply_web_search_tools()`, proactive messaging tool append, and cron-related tool append add built-in tools (e.g., `TavilyWebSearchTool`, `TavilyExtractWebPageTool`, `SendMessageToUserTool`) directly to `req.func_tool` without re-checking the persona's tool allowlist. This means the persona's `tools=[]` restriction is defeated by the tool assembly ordering.
# Vulnerable Code
File: astrbot/core/astr_main_agent.py
Method: build_main_agent() — specifically lines where _apply_web_search_tools() and SendMessageToUserTool are appended after _plugin_tool_fix()
Why: Persona tool filtering is committed into req.func_tool early, but subsequent helper paths (web search, proactive messaging, cron tools) append tools without re-applying the persona restriction. The late-append ordering is the architectural flaw.
# Reproduction
1. Deploy AstrBot with a local OpenAI-compatible mock backend and Dashboard enabled.
2. Create a persona with `tools=[]` via the Dashboard API.
3. Bind that persona to a conversation.
4. Ensure `provider_settings.web_search=True` is configured.
5. Send a chat request via `/api/v1/chat` and observe that the LLM receives `web_search_tavily` and `tavily_extract_web_page` in its tool schema, and the AstrBot runtime log records `Agent 使用工具: ['web_search_tavily']`.
# Impact
- Defeats the security meaning of persona-level tool disablement, allowing operators to unintentionally expose tools in conversations intended to be tool-free.
- An authenticated operator can trigger real tool exposure and invocation through the public `/api/v1/chat` HTTP interface.
- Broader code paths can also re-expose proactive messaging, cron-related, and local/sandbox computer-use tools when those late-append features are enabled. |
|---|
| La source | ⚠️ https://github.com/AstrBotDevs/AstrBot/issues/8780 |
|---|
| Utilisateur | Erichen-x (UID 99082) |
|---|
| Soumission | 18/06/2026 07:45 (il y a 1 mois) |
|---|
| Modérer | 27/07/2026 10:46 (1 month later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 383394 [AstrBotDevs AstrBot jusqu’à 4.25.5 astr_main_agent.py req.func_tool élévation de privilèges] |
|---|
| Points | 20 |
|---|