| Título | nearai IronClaw 0.29.1 Improper Authorization (CWE-285) |
|---|
| Descrição | # Technical Details
A Shell Approval Boundary Bypass via `env /bin/sh -c` Wrapper exists in the command risk classifier in `src/tools/builtin/shell.rs` of IronClaw.
The application classifies command risk by the visible outer token and does not unwrap transparent shell dispatch wrappers. A destructive payload wrapped as `env /bin/sh -c 'chmod 777 /tmp/demo'` is classified from `env`, not from the inner `chmod 777`. The classifier returns `RiskLevel::Medium`, which maps to `ApprovalRequirement::UnlessAutoApproved`. When `shell` has been previously auto-approved in the session, the wrapped destructive command bypasses the per-invocation check and executes through `sh -c`. Direct destructive commands still hit the `Always` floor.
# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: classify_command_risk() — classifies from outer token `env` without unwrapping `/bin/sh -c`; ShellTool::requires_approval() maps both Low and Medium to UnlessAutoApproved
File: src/agent/dispatcher.rs and src/agent/thread_ops.rs
Method: Approval logic skips UnlessAutoApproved when session has auto-approved shell, preserving Always only as the per-call floor
Why: The outer-to-inner wrapper chain is invisible to the prefix classifier, and the approval model trusts the misclassified risk level. Once shell is auto-approved, any UnlessAutoApproved command executes without re-confirmation.
# Reproduction
1. In an IronClaw session with `shell` previously auto-approved, send: `env /bin/sh -c 'chmod 777 /tmp/demo'`.
2. Observe the command is classified as `Medium`, maps to `UnlessAutoApproved`, and skips the fresh approval.
3. Confirm the direct `chmod 777 /tmp/demo` is classified as `High`, maps to `Always`, and still requires approval.
# Impact
- Approval bypass allowing destructive shell behavior (permission changes, file operations) without the intended second approval step.
- Malicious prompt content or prompt-injected context can hide destructive commands behind transparent wrappers.
- Follow-on shell command execution within IronClaw runtime privileges or sandbox/container context. |
|---|
| Fonte | ⚠️ https://github.com/nearai/ironclaw/issues/4865 |
|---|
| Utilizador | Erichen-apple (UID 99087) |
|---|
| Submissão | 18/06/2026 08h42 (há 2 meses) |
|---|
| Moderação | 05/08/2026 18h46 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 386265 [nearai ironclaw até 0.29.1 shell.rs classify_command_risk Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|