| 제목 | TinyAGI tinyagi 0.0.20 Missing Authorization (CWE-862) |
|---|
| 설명 | # Technical Details
A Missing Authorization vulnerability exists in TinyAGI's Anthropic execution path. The public `POST /api/message` endpoint in `packages/server/src/routes/messages.ts` accepts unauthenticated attacker input and enqueues it via `enqueueMessage()`. The queue processor in `packages/main/src/index.ts` then passes the message into `invokeAgent()` without any local permission gate. The Claude provider adapter in `packages/core/src/adapters/claude.ts` initializes the CLI subprocess arguments with `--dangerously-skip-permissions` by default before appending the attacker-controlled prompt with `-p <message>`. This flag disables Claude's provider-side permission approval barrier for tool usage. The source-to-sink chain is: `POST /api/message` → `enqueueMessage()` → SQLite queue → `processMessage()` → `invokeAgent()` → `claude --dangerously-skip-permissions -p <message>`.
# Vulnerable Code
File: packages/server/src/routes/messages.ts (lines 7-16)
Method: POST /api/message handler
Why: Public unauthenticated HTTP entrypoint that accepts attacker-controlled `message` content.
File: packages/core/src/adapters/claude.ts (lines 27-43)
Method: Claude adapter invoke()
Why: Initializes the CLI argument list with `--dangerously-skip-permissions` before appending the attacker-controlled prompt.
File: packages/main/src/index.ts (lines 98-109)
Method: processMessage()
Why: Forwards the queued message into `invokeAgent(...)`, which drives the provider adapter on behalf of the external caller.
# Reproduction
1. Start TinyAGI daemon with a Claude provider configured.
2. Send `POST /api/message` with attacker-controlled prompt content via a PATH shim that captures subprocess argv.
3. Inspect captured sink arguments — confirm `--dangerously-skip-permissions` is present.
4. Run matched control: strip only `--dangerously-skip-permissions` flag, confirm control `captured-control.json` lacks the flag.
5. Observe that the same HTTP entrypoint and queue path are preserved in both cases.
# Impact
- Network-reachable permission-bypass in the default Anthropic execution path.
- Attacker-controlled prompts reach Claude in pre-approved mode, skipping provider-side permission approvals.
- Weakens the last safety barrier for high-risk tool use (local files, command execution, plugins).
- Exposes host running TinyAGI, agent workspace, project files, cached secrets, and reachable systems. |
|---|
| 원천 | ⚠️ https://github.com/TinyAGI/tinyagi/issues/284 |
|---|
| 사용자 | JondaChen (UID 99096) |
|---|
| 제출 | 2026. 06. 18. AM 10:48 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 05. PM 10:20 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 386403 [TinyAGI 0.0.20 Message API Endpoint index.ts processMessage 권한 상승] |
|---|
| 포인트들 | 20 |
|---|