| Título | nanocoai NanoClaw 2.0.64 Improper Authorization (CWE-285) |
|---|
| Descrição | # Technical Details
An Approval Smuggling via Hidden `args` and `env` exists in the `add_mcp_server` approval flow in `src/modules/self-mod/request.ts` of NanoClaw.
The application fails to render the full execution context in the human-visible approval card. The `add_mcp_server` tool accepts `name`, `command`, `args`, and `env` from the container agent and stores all four fields in the approval request. However, the approval question only renders `serverName` and `command`, hiding `args` and `env` from the approver. After approval, `applyAddMcpServer()` persists the hidden fields unchanged into `container_configs.mcp_servers`, and the runtime configuration materialization writes them into `container.json`. An administrator may approve a benign-looking request while unknowingly authorizing hidden command arguments or environment variables.
# Vulnerable Code
File: src/modules/self-mod/request.ts (lines ~78-90)
Method: handleAddMcpServer() — stores full payload but renders question as `Agent "<name>" is attempting to add a new MCP server:\n<serverName> (<command>)`
File: src/modules/self-mod/apply.ts (lines ~98-105)
Method: applyAddMcpServer() — persists hidden args and env into container_configs without revalidation
Why: The approval UI does not bind the administrator's decision to the exact payload. Hidden fields survive the approval step and are materialized into runtime configuration.
# Reproduction
1. Submit an `add_mcp_server` request with `name=safe`, `command=node`, `args=["-e","console.log(\"hidden\")"]`, `env={"NODE_OPTIONS":"--require /tmp/payload.js"}`.
2. Observe the approval question shows only `safe (node)`.
3. After approval, inspect the persisted configuration and container.json — confirm hidden `args` and `env` were stored and materialized.
# Impact
- Administrator can be tricked into approving a benign-looking MCP server while authorizing hidden command-line arguments or environment variables.
- Enables preloading code or altering execution behavior through unrendered env vars.
- Converts a one-time approval into a durable runtime configuration change with hidden execution context. |
|---|
| Fonte | ⚠️ https://github.com/nanocoai/nanoclaw/issues/2762 |
|---|
| Utilizador | JohnChen (UID 99088) |
|---|
| Submissão | 18/06/2026 08h56 (há 2 meses) |
|---|
| Moderação | 05/08/2026 20h48 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 383075 [nanocoai NanoClaw até 2.0.64 add_mcp_server request.ts handleAddMcpServer Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|