| タイトル | AstrBotDevs AstrBot [Needs Manual Input] (unreleased master branch after commit ae44b912) Incorrect Authorization (CWE-863) |
|---|
| 説明 | # Technical Details
A Subagent Handoff Authorization Bypass exists in the `_build_handoff_toolset()` method in `astrbot/core/astr_agent_tool_exec.py` of AstrBot.
The application fails to apply per-tool permission guards when constructing the subagent toolset for `tools=null` configurations. The main-agent path correctly uses `FunctionToolManager.get_full_tool_set()` which wraps non-builtin tools in `_PermissionGuardedTool` (introduced in PR #8693). However, the subagent handoff path in `_build_handoff_toolset()` reconstructs the toolset directly from raw `llm_tools.func_list`, bypassing the `_PermissionGuardedTool` wrapper. This means MCP tools marked as `admin`-only in the dashboard are exposed to member-level chat/API users when a subagent with `tools: null` is triggered.
# Vulnerable Code
File: astrbot/core/astr_agent_tool_exec.py
Method: _build_handoff_toolset() — when `tools is None`, iterates raw `llm_tools.func_list` and adds tools without `_PermissionGuardedTool` wrapping
Why: The subagent path bypasses `get_full_tool_set()` and uses raw tool objects, so the `admin` permission check in `_PermissionGuardedTool._check_tool_permission()` is never invoked for subagent-invoked MCP tools.
# Reproduction
1. Deploy AstrBot from the vulnerable master branch with a local OpenAI-compatible mock provider.
2. Add an MCP stdio server exposing a tool (e.g., `drop_canary`) and mark it as `admin` via `/api/tools/permission`.
3. Configure a subagent with `tools: null`.
4. Using an ordinary member-level chat API key, send a `POST /api/v1/chat` request that causes the main agent to call `transfer_to_worker`.
5. Observe that the subagent invokes `drop_canary` despite the `admin` restriction, with MCP `CallToolRequest` logs and canary file creation confirming the bypass.
# Impact
- A low-privileged member/API chat user can invoke admin-restricted MCP tools through subagent handoff.
- Depending on attached MCP tools, impact can include unauthorized filesystem read/write, host command execution, external API access, and cloud resource manipulation.
- This crosses both the chat trust boundary and the documented per-tool permission boundary. |
|---|
| ソース | ⚠️ https://github.com/AstrBotDevs/AstrBot/issues/8781 |
|---|
| ユーザー | Erichen-apple (UID 99087) |
|---|
| 送信 | 2026年06月18日 08:30 (1 月 ago) |
|---|
| モデレーション | 2026年07月27日 10:46 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 383395 [AstrBotDevs AstrBot 迄 4.25.5 Subagent astr_agent_tool_exec.py _build_handoff_toolset 特権昇格] |
|---|
| ポイント | 20 |
|---|