| タイトル | agentscope-ai AgentScope 2.0.4 CWE-863 Incorrect Authorization |
|---|
| 説明 | The Bash tool of AgentScope hardcodes `tee` in SAFE_COMMANDS (src/agentscope/tool/_builtin/_bash_parser.py:35), the set of commands treated as read-only, even though `tee` is a file-writing command. In check_permissions() Layer 1 (src/agentscope/tool/_builtin/_bash.py:261-267), a command recognized by is_read_only_command() returns PermissionBehavior.ALLOW and short-circuits the remaining six layers of dangerous-command detection, so no user confirmation is requested. A second defense gap exists as well: extract_file_paths() (_bash_parser.py:294-310) does not cover `tee`, so Layer 4 dangerous-path detection would not see tee's target files even if Layer 1 were fixed. The Bash tool is enabled by default and cannot be disabled, and SAFE_COMMANDS is a hard-coded constant the user cannot change. An attacker who can steer a prompt to the agent — remotely without authentication through the X-User-ID header (see CVE-033) or via prompt injection — can therefore achieve arbitrary file write with no user confirmation: `echo <ssh public key> | tee -a authorized_keys` grants passwordless login, `tee -a .bashrc` hijacks shell startup, `tee /etc/crontab` installs a persistent backdoor, and content written to `.env` or configuration files can be read back for credential theft. Verified end to end: no RequireUserConfirmEvent is emitted and the target file is written, while a control command using `>` redirection does trigger the confirmation dialog.
Affected: pip package `agentscope` <= 2.0.4. Patched versions: none.
Reported to the vendor: GitHub Security Advisory GHSA-63wc-c87g-cgcm (submitted 2026-07-08; status Triage as of the 2026-08-30 check, vendor acknowledged receipt, no reply content) + public GitHub issue https://github.com/agentscope-ai/agentscope/issues/3313 (public issue filed 2026-10-14). |
|---|
| ソース | ⚠️ https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-bash-tool-tee-misclassification-arbitrary-file-write.md |
|---|
| ユーザー | Ybyu (UID 101038) |
|---|
| 送信 | 2026年10月14日 10:26 (22 日 ago) |
|---|
| モデレーション | 2026年11月05日 07:26 (22 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 431396 [agentscope-ai AgentScope 迄 2.0.8 Bash Tool _bash.py check_permissions 特権昇格] |
|---|
| ポイント | 20 |
|---|