| Título | nearai IronClaw 0.29.1 Improper Authorization (CWE-285) |
|---|
| Descrição | # Technical Details
A Shell Approval Bypass via `/usr/bin/time` Wrapper exists in the command risk classifier in `src/tools/builtin/shell.rs` of IronClaw.
The application classifies command risk from the first whitespace-delimited token only, without unwrapping transparent wrappers. A destructive command wrapped in `/usr/bin/time -p rm -rf /tmp/x` is classified from `/usr/bin/time` instead of `rm -rf`. The classifier returns `RiskLevel::Medium`, which maps to `ApprovalRequirement::UnlessAutoApproved`. When `shell` has been previously auto-approved in the session via `sess.auto_approve_tool()`, the wrapped destructive payload inherits that prior approval and skips the intended re-prompt.
# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: matches_command_pattern() — uses split_whitespace().next() to get first token; classify_command_risk() derives risk from that token; ShellTool::requires_approval() maps Medium to UnlessAutoApproved
File: src/agent/thread_ops.rs
Method: Session auto-approval persists with sess.auto_approve_tool(), and later UnlessAutoApproved consults sess.is_tool_auto_approved()
Why: The prefix-only classifier treats `/usr/bin/time` as the command identity. Combined with session-level approval persistence, this allows the wrapped command to inherit prior auto-approval.
# Reproduction
1. In an IronClaw session with `shell` previously auto-approved, send: `/usr/bin/time -p rm -rf /tmp/ghsa-qm9x-v7cx-7rq4-marker`.
2. Observe the command is classified as `Medium`, maps to `UnlessAutoApproved`, and does not require fresh approval.
3. Confirm the raw `rm -rf /tmp/ghsa-qm9x-v7cx-7rq4-marker` remains `High` → `Always` and still requires explicit approval.
# Impact
- Approval bypass lowering the protection boundary against prompt injection and malicious content.
- Destructive filesystem operations, unsafe git history rewrites, or other privileged shell actions can proceed without per-execution confirmation.
- Session-level auto-approval is reused by misclassified wrapped commands. |
|---|
| Fonte | ⚠️ https://github.com/nearai/ironclaw/issues/4864 |
|---|
| Utilizador | Erichen-apple (UID 99087) |
|---|
| Submissão | 18/06/2026 08h38 (há 2 meses) |
|---|
| Moderação | 05/08/2026 18h45 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 386265 [nearai ironclaw até 0.29.1 shell.rs classify_command_risk Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|