| Titolo | cosmicstack-labs mercury-agent 1.1.12 Incorrect Privilege Assignment (CWE-266) |
|---|
| Descrizione | # Technical Details
An Incorrect Privilege Assignment vulnerability exists in the `run_command` shell approval system of Mercury Agent. In `src/capabilities/permissions.ts`, `PermissionManager.checkShellCommand()` treats every segment matching `SAFE_READ_PATTERNS` (which includes `echo *`) as read-only and auto-approves it. However, the command is later executed via `spawn(command, [], { shell: true })` in `src/capabilities/shell/run-command.ts`, meaning shell redirection operators like `>` are honored by the real shell. The segment splitter does not model shell redirection as a write-capable semantic, so a payload like `echo CVE_2026_28391_CANARY > canary.txt` is auto-approved as "safe echo" while the shell performs a file write.
# Vulnerable Code
File: src/capabilities/permissions.ts (lines 450-509)
Method: PermissionManager.checkShellCommand() / SAFE_READ_PATTERNS
Why: `echo *` is in the safe-read allowlist, and `checkShellCommand()` auto-approves every segment that matches without recognizing redirection as a write semantic.
File: src/capabilities/shell/run-command.ts (lines 21-33)
Method: executeCommand() / spawn()
Why: The approved command is passed unchanged into `spawn(command, [], { shell: true })`, allowing the real shell to interpret `>` and perform the file write.
# Reproduction
1. Deploy Mercury Agent in Ask Me mode with default permissions.
2. Send a chat prompt that causes the model to invoke `run_command` with `echo CANARY > canary.txt`.
3. Observe that the command is logged as "Shell command auto-approved (safe read-only)" and the canary file is created.
4. Confirm the control case (plain `touch control.txt`) triggers a `permission_request` and is blocked.
# Impact
- Authorization/policy-enforcement bypass on host command execution.
- Attacker can create or overwrite files in Mercury's execution context without user confirmation.
- Integrity impact on source trees, config files, scripts, and working directories. |
|---|
| Fonte | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/72 |
|---|
| Utente | ChenMarry (UID 99089) |
|---|
| Sottomissione | 18/06/2026 09:36 (2 mesi fa) |
|---|
| Moderazione | 05/08/2026 21:41 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 386379 [cosmicstack-labs mercury-agent fino a 1.1.12 run_command permissions.ts PermissionManager.checkShellCommand escalationi di privilegi] |
|---|
| Punti | 20 |
|---|