| タイトル | agentscope-ai AgentScope 2.0.4 CWE-78 Improper Neutralization of Special Elements used in an OS |
|---|
| 説明 | AgentScope v2.0.4 exposes an unauthenticated process-execution path through the MCP workspace API. The POST /workspace/mcp endpoint accepts a stdio MCP configuration whose `command` field is a caller-controlled string: StdioMCPConfig.command (src/agentscope/mcp/_config.py:14) is declared as str with no validators and no allowlist or trusted-directory restriction, and the value is passed through _initialize_client() (src/agentscope/mcp/_mcp_client.py:176-187) into StdioServerParameters()/stdio_client(), which spawns a local child process via subprocess.Popen. The endpoint (src/agentscope/app/_router/_workspace.py:113-130) enforces no server-side authentication or authorization: the caller-supplied X-User-ID header (src/agentscope/app/deps.py:20-42, a self-described "Temporary header-based identity") is accepted as identity context and can be trivially spoofed. For stateful MCPs (stdio is always stateful), add_mcp() calls mcp_client.connect() immediately on save, so the configured process starts before MCP protocol negotiation completes. An attacker who can reach the AgentScope API (default x.x.x.x:8000, LocalWorkspace mode) can register a stdio MCP entry that executes an arbitrary local executable with attacker-controlled arguments, obtaining remote code execution as the OS user running the AgentScope server: disclosure of local files and environment variables (including LLM API keys), modification or deletion of application data, installation of further payloads, and denial of service. No credentials, user interaction, or special preconditions are required beyond network reachability. Dynamically verified 2026-07-08 on Windows 11 (v2.0.4): registering command "cmd" with args ["/c","echo CVE031_POC > marker"] created the marker file containing CVE031_POC; the subsequent HTTP 500/timeout is the expected MCP handshake failure — subprocess.Popen has already spawned the attacker's process. Docker/E2B workspace backends contain the spawned process in the sandbox, but the command still executes within it.
Affected: pip agentscope <= 2.0.4. Patched versions: none.
Reported to the vendor: https://github.com/agentscope-ai/agentscope/security/advisories/GHSA-h4fc-fmm3-h8hg (private advisory, 2026-07-08); https://github.com/agentscope-ai/agentscope/issues/3312 (public issue filed 2026-10-14) |
|---|
| ソース | ⚠️ https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md |
|---|
| ユーザー | Ybyu (UID 101038) |
|---|
| 送信 | 2026年10月14日 10:25 (22 日 ago) |
|---|
| モデレーション | 2026年11月05日 07:26 (22 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 431395 [agentscope-ai AgentScope 迄 2.0.11 MCP Workspace API _config.py subprocess.Popen command 特権昇格] |
|---|
| ポイント | 20 |
|---|