| タイトル | cosmicstack-labs mercury-agent 1.1.12 Incorrect Authorization (CWE-863) |
|---|
| 説明 | # Technical Details
An Incorrect Authorization vulnerability exists in Mercury Agent's shell command classification. In `src/capabilities/permissions.ts`, `SAFE_READ_PATTERNS` includes `find *` as a safe read-only command. However, `find` supports side-effectful actions including `-exec`, `-execdir`, `-ok`, `-okdir`, and `-delete`. Mercury does not apply any argument-level validation to reject these actions. The approved command is then passed directly into `spawn(command, [], { shell: true })` in `src/capabilities/shell/run-command.ts`, allowing a payload like `find . -maxdepth 0 -exec sh -c '...' ';'` to launch a subprocess without triggering the expected permission prompt.
# Vulnerable Code
File: src/capabilities/permissions.ts (lines 450-509)
Method: PermissionManager.checkShellCommand() / SAFE_READ_PATTERNS
Why: `find *` is marked as safe read-only, and `checkShellCommand()` auto-approves any matching segment without rejecting `find` action flags such as `-exec`.
File: src/capabilities/shell/run-command.ts (lines 29-32)
Method: executeCommand() / spawn()
Why: After unsafe approval, `run_command` passes the original command string directly into `spawn(..., { shell: true })`, allowing `find -exec` to launch a subprocess.
# Reproduction
1. Authenticate to Mercury web dashboard in Ask Me mode.
2. Send a chat prompt causing the model to invoke `run_command` with `find . -maxdepth 0 -exec sh -c 'printf CANARY > canary-vuln.txt' ';'`.
3. Observe no `permission_request` event; the command is logged as "Shell command auto-approved (safe read-only)".
4. Confirm `canary-vuln.txt` was created with the expected content.
5. Verify the control path (direct `sh -c '...'`) triggers a `permission_request` and is blocked.
# Impact
- Approval-bypass / authorization-bypass leading to host-level command execution.
- Attacker can execute arbitrary subprocesses with Mercury's OS privileges without the required security prompt.
- Can write/modify files, stage payloads, and combine with other Mercury tools for further abuse. |
|---|
| ソース | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/77 |
|---|
| ユーザー | TrumpChen (UID 99092) |
|---|
| 送信 | 2026年06月18日 09:53 (2 月 ago) |
|---|
| モデレーション | 2026年08月05日 23:25 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 386379 [cosmicstack-labs mercury-agent 迄 1.1.12 run_command permissions.ts PermissionManager.checkShellCommand 特権昇格] |
|---|
| ポイント | 0 |
|---|