| タイトル | HKUDS nanobot 0.2.1 Improper Access Control in MCP Capability Registration (CWE-284) |
|---|
| 説明 | # Technical Details
An MCP capability allowlist bypass exists in the `connect_mcp_servers` method in `nanobot/agent/tools/mcp.py` of nanobot.
The application fails to apply `tools.mcp_servers.<name>.enabled_tools` consistently across MCP capability types. It filters normal entries returned by `session.list_tools()`, but still registers every resource from `session.list_resources()` and every prompt from `session.list_prompts()`. As a result, an operator can set `enabled_tools=[]` and still expose resource-backed data access or prompt-backed workflows.
# Vulnerable Code
File: nanobot/agent/tools/mcp.py
Method: connect_mcp_servers()
Why: The function enforces the allowlist only while iterating ordinary MCP tools. Resource and prompt wrappers are registered unconditionally afterward, causing a deny-all policy to fail open for those capability classes.
# Reproduction
1. Start a real stdio MCP server exposing one normal tool, one resource, and one prompt, then configure nanobot 0.2.1 with `enabled_tools=[]`.
2. Connect the server through nanobot’s real MCP registration path using the provided verification harness.
3. Observe that the normal tool is skipped, but `mcp_demo_resource_canary` and `mcp_demo_prompt_canary_prompt` remain registered and executable through `ToolRegistry.execute()`.
# Impact
- Operators cannot rely on `enabled_tools=[]` or a narrowed allowlist to suppress all MCP-derived capabilities from a server.
- Sensitive MCP resources or privileged prompt workflows may remain model-callable despite an explicit deny-all policy. |
|---|
| ソース | ⚠️ https://gist.github.com/YLChen-007/3de5f50d167a878f7530f57ed018d508 |
|---|
| ユーザー | Eric-c (UID 96848) |
|---|
| 送信 | 2026年06月22日 04:21 (2 月 ago) |
|---|
| モデレーション | 2026年08月07日 14:07 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 386998 [HKUDS nanobot 迄 0.2.1 MCP enabledTools Scope mcp.py connect_mcp_servers 特権昇格] |
|---|
| ポイント | 20 |
|---|