| शीर्षक | nearai IronClaw 0.29.1 Improper Authorization (CWE-285) |
|---|
| विवरण | # Technical Details
A Shell Approval Bypass via `/usr/bin/time` Wrapper exists in the command risk classifier in `src/tools/builtin/shell.rs` of IronClaw.
The application classifies command risk from the first whitespace-delimited token only, without unwrapping transparent wrappers. A destructive command wrapped in `/usr/bin/time -p rm -rf /tmp/x` is classified from `/usr/bin/time` instead of `rm -rf`. The classifier returns `RiskLevel::Medium`, which maps to `ApprovalRequirement::UnlessAutoApproved`. When `shell` has been previously auto-approved in the session via `sess.auto_approve_tool()`, the wrapped destructive payload inherits that prior approval and skips the intended re-prompt.
# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: matches_command_pattern() — uses split_whitespace().next() to get first token; classify_command_risk() derives risk from that token; ShellTool::requires_approval() maps Medium to UnlessAutoApproved
File: src/agent/thread_ops.rs
Method: Session auto-approval persists with sess.auto_approve_tool(), and later UnlessAutoApproved consults sess.is_tool_auto_approved()
Why: The prefix-only classifier treats `/usr/bin/time` as the command identity. Combined with session-level approval persistence, this allows the wrapped command to inherit prior auto-approval.
# Reproduction
1. In an IronClaw session with `shell` previously auto-approved, send: `/usr/bin/time -p rm -rf /tmp/ghsa-qm9x-v7cx-7rq4-marker`.
2. Observe the command is classified as `Medium`, maps to `UnlessAutoApproved`, and does not require fresh approval.
3. Confirm the raw `rm -rf /tmp/ghsa-qm9x-v7cx-7rq4-marker` remains `High` → `Always` and still requires explicit approval.
# Impact
- Approval bypass lowering the protection boundary against prompt injection and malicious content.
- Destructive filesystem operations, unsafe git history rewrites, or other privileged shell actions can proceed without per-execution confirmation.
- Session-level auto-approval is reused by misclassified wrapped commands. |
|---|
| स्रोत | ⚠️ https://github.com/nearai/ironclaw/issues/4864 |
|---|
| उपयोगकर्ता | Erichen-apple (UID 99087) |
|---|
| सबमिशन | 18/06/2026 08:38 AM (2 महीनों पहले) |
|---|
| संयम | 05/08/2026 06:45 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 386265 [nearai ironclaw तक 0.29.1 shell.rs classify_command_risk अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|