| Título | HKUDS AnyTool 0.1.0 cwe-78 |
|---|
| Descrição | AnyTool is a Python framework that gives AI agents tool-use capabilities, including shell command execution via a local HTTP "desktop control server" (anytool/local_server/main.py, Flask). The server is started with "python -m anytool.local_server.main", binds 127.0.0.1:5000 by default, and explicitly supports network exposure (--host x.x.x.x, documented in --help and anytool/local_server/README.md) for the product's cross-machine "vm_ip" deployment architecture where the server runs on a different host than the agent.
The POST /execute endpoint (and its alias POST /setup/execute) has no authentication of any kind (no before_request hook, no API key/token check anywhere in the file). The JSON body fields "command" (string or list) and "shell" (boolean) are passed verbatim into subprocess.run(command, shell=shell, ...) at main.py lines 211/221. With "shell": true the raw request string is handed to the OS shell as-is; shlex.split() (lines 200-201) only runs in the shell=false path and merely tokenizes. The command's stdout, stderr and exit code are returned in the HTTP response.
Proof of concept (harmless payloads, verified 2026-08-27 against commit 506430fec13300853b2010e2604ae0c71b940502, the current HEAD of main; Windows 10, Python 3.13.6, Flask 3.1.3):
curl -s -X POST http://127.0.0.1:5000/execute -H 'Content-Type: application/json' -d '{"command": "echo PWNED && whoami", "shell": true}'
Response: {"error":"","output":"PWNED <server-user>","returncode":0,"status":"success"}
"&&" chaining is honoured, confirming full shell semantics. An automated 3-case PoC (stdlib-only Python, timestamped markers, dual-view evidence: client output plus server access log) is included in the public disclosure linked in the Advisory field: shell-true string execution, shell metacharacter chaining via the alias route, and argv-list execution of arbitrary local binaries (shell=false).
Impact: any party that can reach the listening port achieves unauthenticated remote code execution with the privileges of the server process. In network-exposed deployments (--host x.x.x.x / vm_ip architecture, both supported by the product): CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical. In the default localhost deployment, exploitation remains possible via DNS rebinding from a malicious web page (the server performs no Host/Origin header validation — verified by sending requests with arbitrary Host/Origin headers), by other users on multi-user hosts, and by any local process: CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.1 High.
Related issues in the same file and same no-authentication attack surface (same class, reported separately or already public): /execute_with_verification passes verification.command_success to subprocess.run with hardcoded shell=True (main.py:328-334), publicly reported in the project's issue #4 (2026-01-27) with an unmerged fix PR #5; /launch_app uses subprocess.Popen(command, shell=shell) (main.py:403); /run_python and /run_bash_script write attacker-supplied code to temp files and execute them; on macOS, /setup/activate_window and /wallpaper interpolate request fields unescaped into AppleScript strings executed via osascript (platform_adapters/macos_adapter.py:59-61, :111, :349).
CWE: CWE-78 (OS Command Injection); the underlying access-control flaw is CWE-306 (Missing Authentication for Critical Function).
Product identification note: this is the GitHub-distributed project HKUDS/AnyTool (MIT licence, ~686 stars), NOT the unrelated PyPI package "anytool" (ayudo-ai). The repository has no tags/releases; the affected version is the main branch at commit 506430fec13300853b2010e2604ae0c71b940502 (pushed 2026-02-28, the newest commit; repository dormant since).
Vendor notification: public GitHub issue filed (see Advisory link). The repository has no SECURITY.md and GitHub private vulnerability reporting is disabled; public issues are the established disclosure channel for this project (precedent: issue #4). |
|---|
| Fonte | ⚠️ https://github.com/HKUDS/AnyTool/issues/6 |
|---|
| Utilizador | Ccruch (UID 99803) |
|---|
| Submissão | 27/08/2026 15h17 (há 1 mês) |
|---|
| Moderação | 29/09/2026 19h31 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 411510 [HKUDS AnyTool 0.1.0 Execute Endpoint main.py subprocess.run command/shell Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|