| タイトル | louisho5 picobot 0.2.0 Incomplete List of Disallowed Inputs (CWE-184) |
|---|
| 説明 | # Technical Details
A dangerous-program blacklist bypass vulnerability exists in the `[ExecTool.Execute]` method in `internal/agent/tools/exec.go` of picobot.
The application fails to recursively inspect wrapped command dispatch. The blacklist only checks `argv[0]`, so a blocked payload such as `rm` can be hidden behind `/usr/bin/env bash -lc`. The command array `["/usr/bin/env","bash","-lc","rm /abs/path/to/marker.txt"]` passes validation and reaches `exec.CommandContext`, which launches `env`, dispatches `bash`, and executes the prohibited command.
# Vulnerable Code
File: `internal/agent/tools/exec.go`
Method: `ExecTool.Execute`
Why: The safety policy inspects only the top-level executable and not nested shell-wrapper execution chains, making the blacklist incomplete and bypassable.
# Reproduction
1. Run the supplied harness with a local provider that returns an `exec` tool call containing `["/usr/bin/env","bash","-lc","rm /abs/path/to/marker.txt"]`.
2. Invoke the normal `picobot agent -m` CLI path so the provider tool call is executed.
3. Confirm the marker file is deleted, while the direct control payload `["rm","/abs/path/to/marker.txt"]` is rejected.
# Impact
- Bypasses Picobot’s intended dangerous-program restrictions for the `exec` tool.
- Enables destructive command execution through wrapper-based dispatch under the Picobot process account. |
|---|
| ソース | ⚠️ https://github.com/louisho5/picobot/issues/43 |
|---|
| ユーザー | Eric-h (UID 97582) |
|---|
| 送信 | 2026年06月11日 11:27 (1 月 ago) |
|---|
| モデレーション | 2026年07月13日 23:12 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 378163 [louisho5 picobot 迄 0.2.0 exec Tool exec.go ExecTool.Execute 特権昇格] |
|---|
| ポイント | 0 |
|---|