| タイトル | HKUDS nanobot 0.2.1 Improper Access Control in MCP Wrapper Exposure (CWE-284) |
|---|
| 説明 | # Technical Details
An MCP scope bypass exists in the `connect_mcp_servers` method in `nanobot/agent/tools/mcp.py` of nanobot.
The application fails to enforce `tools.mcpServers.<name>.enabledTools` for resource and prompt wrappers during live gateway operation. Even with `enabledTools: []`, nanobot 0.2.1 still registers and exposes resource and prompt wrappers in the Settings API and in the actual tool list sent to the LLM provider during a WebSocket turn.
# Vulnerable Code
File: nanobot/agent/tools/mcp.py
Method: connect_mcp_servers()
Why: The registration code filters only `session.list_tools()` results. It then registers wrappers from `session.list_resources()` and `session.list_prompts()` without the same policy check, so leaked wrappers remain visible and callable end-to-end.
# Reproduction
1. Start a real `nanobot gateway` with a local MCP server exposing one ordinary tool, one resource, and one prompt, and configure `enabledTools: []`.
2. Use the provided deterministic provider and verification scripts to inspect `/api/settings/mcp-presets/test` or trigger a live WebSocket chat turn.
3. Observe that the ordinary MCP tool is absent, but `mcp_demo_resource_canary_resource` and `mcp_demo_prompt_canary_prompt` still appear in the registered/model-facing tool list.
# Impact
- A supposedly deny-all or narrowed MCP policy still leaks model-callable wrappers derived from resources and prompts.
- Sensitive internal reads, templates, or privileged prompt workflows may remain exposed through the gateway despite explicit operator restrictions. |
|---|
| ソース | ⚠️ https://gist.github.com/YLChen-007/64ee28f96041fc6baaec89a85b63c3b2 |
|---|
| ユーザー | Eric-c (UID 96848) |
|---|
| 送信 | 2026年06月22日 04:22 (2 月 ago) |
|---|
| モデレーション | 2026年08月07日 14:07 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 386998 [HKUDS nanobot 迄 0.2.1 MCP enabledTools Scope mcp.py connect_mcp_servers 特権昇格] |
|---|
| ポイント | 0 |
|---|