提出 #865116: HKUDS nanobot 0.2.1 Improper Access Control in MCP Capability Registration (CWE-284)情報

タイトルHKUDS nanobot 0.2.1 Improper Access Control in MCP Capability Registration (CWE-284)
説明# Technical Details An MCP capability allowlist bypass exists in the `connect_mcp_servers` method in `nanobot/agent/tools/mcp.py` of nanobot. The application fails to apply `tools.mcp_servers.<name>.enabled_tools` consistently across MCP capability types. It filters normal entries returned by `session.list_tools()`, but still registers every resource from `session.list_resources()` and every prompt from `session.list_prompts()`. As a result, an operator can set `enabled_tools=[]` and still expose resource-backed data access or prompt-backed workflows. # Vulnerable Code File: nanobot/agent/tools/mcp.py Method: connect_mcp_servers() Why: The function enforces the allowlist only while iterating ordinary MCP tools. Resource and prompt wrappers are registered unconditionally afterward, causing a deny-all policy to fail open for those capability classes. # Reproduction 1. Start a real stdio MCP server exposing one normal tool, one resource, and one prompt, then configure nanobot 0.2.1 with `enabled_tools=[]`. 2. Connect the server through nanobot’s real MCP registration path using the provided verification harness. 3. Observe that the normal tool is skipped, but `mcp_demo_resource_canary` and `mcp_demo_prompt_canary_prompt` remain registered and executable through `ToolRegistry.execute()`. # Impact - Operators cannot rely on `enabled_tools=[]` or a narrowed allowlist to suppress all MCP-derived capabilities from a server. - Sensitive MCP resources or privileged prompt workflows may remain model-callable despite an explicit deny-all policy.
ソース⚠️ https://gist.github.com/YLChen-007/3de5f50d167a878f7530f57ed018d508
ユーザー
 Eric-c (UID 96848)
送信2026年06月22日 04:21 (2 月 ago)
モデレーション2026年08月07日 14:07 (2 months later)
ステータス承諾済み
VulDBエントリ386998 [HKUDS nanobot 迄 0.2.1 MCP enabledTools Scope mcp.py connect_mcp_servers 特権昇格]
ポイント20

Interested in the pricing of exploits?

See the underground prices here!