| 제목 | HKUDS nanobot 0.2.1 Command Injection via Shell-Chain Allowlist Bypass (CWE-88) |
|---|
| 설명 | # Technical Details
A shell-chain allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.
The application fails to enforce `tools.exec.allowPatterns` on the full effective shell behavior. It lowercases the raw command string, approves it if a loose pattern like `\\becho\\s+allowlisted\\b` matches anywhere, and then executes the same string with `bash -c`. A payload such as `echo allowlisted && touch /workspace/canary-created` therefore inherits approval from its first segment and still executes the appended command.
# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: The allowlist logic is substring-based and shell-unaware, while the execution path is shell-aware. That check/execute mismatch lets `&&` or other shell separators smuggle unauthorized commands past the policy boundary.
# Reproduction
1. Run the provided end-to-end lab for nanobot 0.2.1 with a vulnerable config using `allowPatterns: ["\\becho\\s+allowlisted\\b"]` and a fake provider that triggers the `exec` tool.
2. Send the command `echo allowlisted && touch "<canary-path>"` through the real OpenAI-compatible service flow.
3. Observe that the vulnerable workspace contains `canary-created`, while the control instance using `^echo\\s+allowlisted$` records an allowlist error and does not create its canary.
# Impact
- An attacker who can induce an `exec` tool call can execute unintended shell commands under the nanobot process account.
- Files in the agent workspace can be created, modified, or deleted, enabling follow-on tampering or broader compromise where stronger isolation is absent. |
|---|
| 원천 | ⚠️ https://gist.github.com/YLChen-007/da7ee2c191ffbfa46ccd12ee66f5bf85 |
|---|
| 사용자 | Eric-c (UID 96848) |
|---|
| 제출 | 2026. 06. 22. AM 04:28 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 07. PM 02:07 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 386997 [HKUDS nanobot 까지 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn 권한 상승] |
|---|
| 포인트들 | 0 |
|---|