| 제목 | cosmicstack-labs mercury-agent 1.1.12 Incorrect Authorization (CWE-863) |
|---|
| 설명 | # Technical Details
An Incorrect Authorization vulnerability exists in Mercury Agent's `/bg <command>` chat feature. The `Agent.handleBgCommand()` method in `src/core/agent.ts` forwards the raw command string directly into the background shell runner via `backgroundTasks.spawnShell(command, cwd)` without any call to `PermissionManager.checkShellCommand()`. Meanwhile, the normal `run_command` tool path correctly enforces the approval boundary before execution. This creates a dual-path inconsistency: the guarded `run_command` path prompts for approval, while the unguarded `/bg` path silently executes commands through `spawn(..., { shell: true })` in `src/core/background-tasks.ts`.
# Vulnerable Code
File: src/core/agent.ts (lines 656-664)
Method: Agent.handleBgCommand()
Why: Accepts `/bg <command>` input and forwards it directly to `backgroundTasks.spawnShell(command, cwd)` without any shell permission check.
File: src/core/background-tasks.ts (lines 132-156)
Method: BackgroundTasks.spawnShell()
Why: Executes the attacker-controlled command string through `spawn(..., { shell: true })`, making the bypassed shell sink explicit.
File: src/capabilities/permissions.ts (lines 501-515)
Method: PermissionManager.checkShellCommand()
Why: In Ask Me mode non-safe commands should invoke `askHandler("Run command: ...")`, but the `/bg` path never reaches this logic.
# Reproduction
1. Authenticate to Mercury web dashboard via `POST /api/auth/login`.
2. Send chat content via `POST /api/chat/send` with `/bg touch /tmp/bg-bypass-canary.txt`.
3. Observe the canary file is created without any `permission_request` event.
4. Confirm the control path (`run_command("touch ...")`) triggers a `permission_request` and blocks execution.
# Impact
- Authenticated arbitrary command execution gated only by web dashboard access.
- Attacker can execute shell commands silently through `/bg` without `Ask Me` approval.
- OS-level reach over workspace, source code, build scripts, `~/.mercury` secrets. |
|---|
| 원천 | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/73 |
|---|
| 사용자 | ChenMarry (UID 99089) |
|---|
| 제출 | 2026. 06. 18. AM 09:36 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 05. PM 09:41 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 386380 [cosmicstack-labs mercury-agent 까지 1.1.12 bg Command src/core/agent.ts Agent.handleBgCommand 권한 상승] |
|---|
| 포인트들 | 20 |
|---|