| タイトル | cosmicstack-labs mercury-agent 1.1.12 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| 説明 | # Technical Details
A sensitive information disclosure vulnerability exists in Mercury Agent's `run_command` shell approval system. In `src/capabilities/permissions.ts`, `SAFE_READ_PATTERNS` includes `echo *` and `checkShellCommand()` auto-approves any matching segment as safe read-only. However, in `src/capabilities/shell/run-command.ts`, the approved command is executed through `spawn(command, [], { shell: true })`, which performs shell variable expansion. A payload like `echo $SECRET_VAR` is approved as a read-only echo, but the shell expands the environment variable and reveals its value in the output without triggering an Ask Me approval prompt.
# Vulnerable Code
File: src/capabilities/permissions.ts (lines 450-509)
Method: PermissionManager.checkShellCommand() / SAFE_READ_PATTERNS
Why: `echo *` is classified as safe read-only but shell variable expansion is not considered as a sensitive data disclosure path.
File: src/capabilities/shell/run-command.ts (lines 29-33)
Method: executeCommand() / spawn()
Why: `spawn(command, [], { shell: true })` executes the approved command through a real shell, which expands environment variables at execution time.
File: src/web/api/chat.ts (lines 110-123)
Method: Chat API endpoint
Why: Authenticated web chat input reaches the agent tool loop through `POST /api/chat/send`, making the vulnerable path reachable.
# Reproduction
1. Set a canary environment variable in the Mercury process (e.g., `MERCURY_CANARY=secret_value`).
2. Send a chat prompt causing the model to invoke `run_command` with `echo $MERCURY_CANARY`.
3. Observe the command is auto-approved as "safe read-only" without a permission prompt.
4. The tool output contains the expanded environment variable value.
5. Confirm the control case (direct `printenv`) triggers a `permission_request` and is blocked.
# Impact
- Environment secrets stored in the Mercury process can be disclosed without an Ask Me prompt.
- Can leak provider API keys, bot tokens, or other local runtime credentials.
- Information disclosure bypass that undermines the Ask Me security model. |
|---|
| ソース | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/76 |
|---|
| ユーザー | ChenMarry (UID 99089) |
|---|
| 送信 | 2026年06月18日 09:38 (2 月 ago) |
|---|
| モデレーション | 2026年08月05日 21:41 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 386379 [cosmicstack-labs mercury-agent 迄 1.1.12 run_command permissions.ts PermissionManager.checkShellCommand 特権昇格] |
|---|
| ポイント | 0 |
|---|