| शीर्षक | HKUDS nanobot 0.2.1 Command Injection via Shell-Chain Allowlist Bypass (CWE-88) |
|---|
| विवरण | # Technical Details
A shell-chain allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.
The application fails to enforce `tools.exec.allowPatterns` on the full effective shell behavior. It lowercases the raw command string, approves it if a loose pattern like `\\becho\\s+allowlisted\\b` matches anywhere, and then executes the same string with `bash -c`. A payload such as `echo allowlisted && touch /workspace/canary-created` therefore inherits approval from its first segment and still executes the appended command.
# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: The allowlist logic is substring-based and shell-unaware, while the execution path is shell-aware. That check/execute mismatch lets `&&` or other shell separators smuggle unauthorized commands past the policy boundary.
# Reproduction
1. Run the provided end-to-end lab for nanobot 0.2.1 with a vulnerable config using `allowPatterns: ["\\becho\\s+allowlisted\\b"]` and a fake provider that triggers the `exec` tool.
2. Send the command `echo allowlisted && touch "<canary-path>"` through the real OpenAI-compatible service flow.
3. Observe that the vulnerable workspace contains `canary-created`, while the control instance using `^echo\\s+allowlisted$` records an allowlist error and does not create its canary.
# Impact
- An attacker who can induce an `exec` tool call can execute unintended shell commands under the nanobot process account.
- Files in the agent workspace can be created, modified, or deleted, enabling follow-on tampering or broader compromise where stronger isolation is absent. |
|---|
| स्रोत | ⚠️ https://gist.github.com/YLChen-007/da7ee2c191ffbfa46ccd12ee66f5bf85 |
|---|
| उपयोगकर्ता | Eric-c (UID 96848) |
|---|
| सबमिशन | 22/06/2026 04:28 AM (3 महीनों पहले) |
|---|
| संयम | 07/08/2026 02:07 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 386997 [HKUDS nanobot तक 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|