| Titolo | NousResearch hermes-agent unreleased upstream main (after v2026.6.5) Improper Access Control (CWE-284) |
|---|
| Descrizione | # Technical Details
An authorization bypass exists in the SimpleX gateway sender allowlist in hermes-agent upstream main branch.
The SimpleX adapter maps attacker-controlled profile metadata (`localDisplayName` / `profile.displayName`) into `SessionSource.user_name`, while the gateway authorization logic (`gateway/authz_mixin.py`) adds `source.user_name` to the set of identities checked against `SIMPLEX_ALLOWED_USERS`. Because `user_name` is mutable display-name data rather than the stable authenticated `contactId` (stored in `user_id`), a different SimpleX contact can set their display name to match an allowlisted value and satisfy the sender allowlist check even when their stable `contactId` does not match.
# Vulnerable Code
File: plugins/platforms/simplex/adapter.py
Method: connect() -> SessionSource construction
Why: The adapter builds `SessionSource` with `user_id=sender_id` (stable) and `user_name=sender_name or sender_id` (mutable), carrying attacker-controlled display-name data into gateway authorization.
File: gateway/authz_mixin.py
Method: SimpleX authorization branch
Why: The authorization logic explicitly adds `source.user_name` to `check_ids`, allowing a mutable display name to satisfy `SIMPLEX_ALLOWED_USERS` exactly like the stable sender identity.
# Reproduction
1. Checkout NousResearch/hermes-agent at an upstream main commit after `490c486ff65b766d9de0fe0e6f26e1778aaa8fb3`.
2. Configure `SIMPLEX_ALLOWED_USERS=alice`.
3. Craft an inbound SimpleX payload with `contactId='attacker-7'` and `displayName='alice'`.
4. Observe authorization returns `True` despite the mismatched stable contact ID.
5. Run the control with `SIMPLEX_ALLOWED_USERS=victim-id` and observe authorization returns `False`.
# Impact
- Remote SimpleX contacts can bypass the sender allowlist by matching a display name.
- Unauthorized senders reach the gateway and downstream agent/tool execution path.
- Can expose terminal, filesystem, browser, automation, or plugin-backed capabilities. |
|---|
| Fonte | ⚠️ https://gist.github.com/YLChen-007/a051533e92f7b854b1a272e6a6e08bb9 |
|---|
| Utente | Eric-y (UID 95889) |
|---|
| Sottomissione | 12/06/2026 11:40 (2 mesi fa) |
|---|
| Moderazione | 04/08/2026 09:35 (2 months later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 383065 [NousResearch hermes-agent 2026.6.5 SimpleX Gateway Authorization adapter.py contactId escalationi di privilegi] |
|---|
| Punti | 0 |
|---|