| タイトル | nearai IronClaw 0.29.1 Improper Authorization (CWE-285) |
|---|
| 説明 | # Technical Details
A Shell Approval Bypass via `sort --compress-program` exists in the low-risk allowlist in `src/tools/builtin/shell.rs` of IronClaw.
The application classifies `sort` as a low-risk command in the `LOW_RISK_PATTERNS` table without considering that GNU `sort` supports `--compress-program`, which delegates execution to an attacker-chosen external helper. When `shell` is configured as `AlwaysAllow`, a command beginning with `sort --compress-program=<helper>` is classified as `RiskLevel::Low`, maps to `ApprovalRequirement::UnlessAutoApproved`, and executes without a fresh approval prompt. The external helper program runs under the IronClaw process context.
# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: LOW_RISK_PATTERNS table includes "sort" as read-only; classify_command_risk() returns Low for sort-prefixed segments without inspecting `--compress-program`
Why: `sort` is trusted as a safe/read-only binary, but its `--compress-program` flag allows arbitrary external helper execution that the classifier does not detect.
# Reproduction
1. Deploy IronClaw with `shell=AlwaysAllow` and GNU `sort` available on the host.
2. Send a shell command: `sort --compress-program=/path/to/helper.sh /dev/null`.
3. Observe that the external helper script executes and creates filesystem canary evidence.
4. Confirm the command was classified as `Low` risk and auto-approved.
# Impact
- Approval bypass enabling host- or container-context command execution through a helper program delegated by GNU `sort`.
- An authenticated user or prompt-influenced LLM action can spawn attacker-selected external programs.
- Defeats the explicit-approval safety boundary for commands that appear benign by prefix. |
|---|
| ソース | ⚠️ https://github.com/nearai/ironclaw/issues/4862 |
|---|
| ユーザー | Erichen-apple (UID 99087) |
|---|
| 送信 | 2026年06月18日 08:37 (2 月 ago) |
|---|
| モデレーション | 2026年08月05日 18:45 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 386265 [nearai ironclaw 迄 0.29.1 shell.rs classify_command_risk 特権昇格] |
|---|
| ポイント | 0 |
|---|