| 제목 | OpenBMB Internet of Agents(IoA) 9d78e88 Code Injection |
|---|
| 설명 | A vulnerability was found in OpenBMB Internet of Agents up to commit 9d78e88. It has been declared as critical. This vulnerability affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. The manipulation of the argument filename/lang leads to code injection. It is possible to launch the attack remotely.
Details: the execute_code tool states in its docstring that it executes code in a docker container, but it actually runs a local subprocess in the current process without any sandbox, chroot, privilege drop, or resource limits. The filename argument is concatenated with os.path.join(work_dir, filename) without sanitization, so "../" escapes the extensions directory and writes arbitrary files; passing code=None executes an existing file. The lang argument maps bash/sh/shell/powershell to local shells.
Attack flow: a malicious agent joins a team (trivial via the unauthenticated registration) and, in the course of normal collaboration, induces the victim agent's LLM to call execute_code; the supplied code then runs with the victim agent's process privileges. In the provided Docker orchestration the tool-agent containers run privileged and mount /var/run/docker.sock, which escalates this to host-level control.
Proof of concept (direct invocation of the real tool code): (1) execute_code(code="import os, sys; print(os.getlogin(), os.getpid(), sys.executable)", lang="python") prints the host OS user and the local Python interpreter path, proving execution outside any container; (2) execute_code(code="echo pwned", lang="bash") executes a local shell; (3) execute_code(code="written by path traversal", filename="../poc/PWNED_traversal.txt") writes a file outside the extensions directory; (4) a single call can allocate 256MB of memory without any limit.
Impact: arbitrary python/bash/sh/powershell code executes with the agent process privileges, arbitrary-path file writes are possible, and memory/CPU can be exhausted; combined with the privileged tool containers it escalates to host-level command execution.
Suggested fix: execute code in a real non-privileged container with no host mounts and no network by default; accept basenames only for filename and restrict extensions; enforce memory/CPU/process/timeout limits; disable shell languages by default and require explicit authorization; remove privileged=True and the /var/run/docker.sock mount from the tool-agent containers. |
|---|
| 원천 | ⚠️ https://github.com/OpenBMB/IoA/issues/18 |
|---|
| 사용자 | Evo1ution (UID 101872) |
|---|
| 제출 | 2026. 10. 14. PM 02:47 (24 날 ago) |
|---|
| 모더레이션 | 2026. 11. 06. AM 10:37 (23 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 431792 [OpenBMB Internet of Agents 까지 9d78e88e47160eb42ee1ee8538c05e1c2c47877a Code Executor Tool code_executor.py execute_code filename/lang 권한 상승] |
|---|
| 포인트들 | 20 |
|---|