| शीर्षक | nearai IronClaw 0.29.1 Improper Authorization (CWE-285) |
|---|
| विवरण | # Technical Details
A Shell Approval Bypass via Transparent `env`/shell Wrappers exists in the `classify_command_risk()` method in `src/tools/builtin/shell.rs` of IronClaw.
The application classifies command risk by the first visible token only, without unwrapping transparent dispatch wrappers. A destructive command wrapped in `/usr/bin/env bash -lc "rm -rf ..."` is classified from `env` instead of the effective inner payload `rm -rf`. The classifier returns `RiskLevel::Medium`, which maps to `ApprovalRequirement::UnlessAutoApproved` instead of `Always`. When `shell` has been previously auto-approved in the session, the wrapped destructive payload skips the explicit re-confirmation that a raw `rm -rf` would require.
# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: classify_command_risk() and matches_command_pattern() — only inspect the first whitespace-delimited token per segment; ShellTool::requires_approval() maps Medium to UnlessAutoApproved
Why: The prefix-only classifier cannot see through transparent wrappers like `/usr/bin/env bash -lc`, so the effective inner destructive command is hidden from the high-risk matcher.
# Reproduction
1. In an IronClaw session with `shell` previously auto-approved, send: `/usr/bin/env bash -lc "rm -rf /tmp/marker"`.
2. Observe the command is classified as `Medium` (from `env`), maps to `UnlessAutoApproved`, and skips the fresh approval prompt.
3. Confirm the direct command `rm -rf /tmp/marker` is classified as `High`, maps to `Always`, and still requires approval.
# Impact
- Approval bypass allowing high-risk shell actions to avoid the explicit per-invocation confirmation floor.
- Enables prompt injection or malicious context to route destructive commands through transparent wrappers.
- Can lead to filesystem destruction, source-control damage, or chained shell-based compromise. |
|---|
| स्रोत | ⚠️ https://github.com/nearai/ironclaw/issues/4863 |
|---|
| उपयोगकर्ता | Erichen-apple (UID 99087) |
|---|
| सबमिशन | 18/06/2026 08:38 AM (2 महीनों पहले) |
|---|
| संयम | 05/08/2026 06:45 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 386265 [nearai ironclaw तक 0.29.1 shell.rs classify_command_risk अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|