| Titre | cosmicstack-labs mercury-agent 1.1.12 Incorrect Authorization (CWE-863) |
|---|
| Description | # Technical Details
An Incorrect Authorization vulnerability exists in Mercury Agent's `/bg <command>` chat feature. The `Agent.handleBgCommand()` method in `src/core/agent.ts` forwards the raw command string directly into the background shell runner via `backgroundTasks.spawnShell(command, cwd)` without any call to `PermissionManager.checkShellCommand()`. Meanwhile, the normal `run_command` tool path correctly enforces the approval boundary before execution. This creates a dual-path inconsistency: the guarded `run_command` path prompts for approval, while the unguarded `/bg` path silently executes commands through `spawn(..., { shell: true })` in `src/core/background-tasks.ts`.
# Vulnerable Code
File: src/core/agent.ts (lines 656-664)
Method: Agent.handleBgCommand()
Why: Accepts `/bg <command>` input and forwards it directly to `backgroundTasks.spawnShell(command, cwd)` without any shell permission check.
File: src/core/background-tasks.ts (lines 132-156)
Method: BackgroundTasks.spawnShell()
Why: Executes the attacker-controlled command string through `spawn(..., { shell: true })`, making the bypassed shell sink explicit.
File: src/capabilities/permissions.ts (lines 501-515)
Method: PermissionManager.checkShellCommand()
Why: In Ask Me mode non-safe commands should invoke `askHandler("Run command: ...")`, but the `/bg` path never reaches this logic.
# Reproduction
1. Authenticate to Mercury web dashboard via `POST /api/auth/login`.
2. Send chat content via `POST /api/chat/send` with `/bg touch /tmp/bg-bypass-canary.txt`.
3. Observe the canary file is created without any `permission_request` event.
4. Confirm the control path (`run_command("touch ...")`) triggers a `permission_request` and blocks execution.
# Impact
- Authenticated arbitrary command execution gated only by web dashboard access.
- Attacker can execute shell commands silently through `/bg` without `Ask Me` approval.
- OS-level reach over workspace, source code, build scripts, `~/.mercury` secrets. |
|---|
| La source | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/73 |
|---|
| Utilisateur | ChenMarry (UID 99089) |
|---|
| Soumission | 18/06/2026 09:36 (il y a 2 mois) |
|---|
| Modérer | 05/08/2026 21:41 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 386380 [cosmicstack-labs mercury-agent jusqu’à 1.1.12 bg Command src/core/agent.ts Agent.handleBgCommand élévation de privilèges] |
|---|
| Points | 20 |
|---|