| Название | OpenBMB Internet of Agents(IoA) 9d78e88 Improper Access Controls |
|---|
| Описание | A vulnerability was found in OpenBMB Internet of Agents up to commit 9d78e88. This vulnerability affects the function fetch_chat_record and the websocket message handling of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id leads to improper access controls. It is possible to launch the attack remotely.
Details: the websocket message loop does not verify that the sender is a member of the session or that the sender matches the connection identity. Any websocket connection can send unlimited messages to any known comm_id; each message triggers a full read-modify-write of the chat database, a deepcopy, a push to the frontend, and a broadcast to every session member. In addition, the /fetch_chat_record endpoint accepts comm_id=None and returns the entire chat database without authentication or pagination.
Proof of concept (live deployment): create a session with 20 members and connect them all; from a websocket connection using a non-member, unregistered name, send 30 messages of 20KB each to the session comm_id. All 30 messages are accepted, appended to the chat database (growth of about 0.6MB within 4 seconds), and broadcast to all 20 members (20x network amplification). Calling /fetch_chat_record with comm_id=None returns the entire chat database without any credentials.
Impact: network amplification proportional to the member count, sustained CPU and disk consumption, flooding of victim team discussions, and unauthenticated disclosure of any session's chat records, including goals, plans, task conclusions, and tool outputs.
Suggested fix: verify that the sender is a session member and that the sender equals the connection identity; add per-session and per-connection rate limits and message size caps; require comm_id, authentication, and pagination for /fetch_chat_record; filter dead receivers before broadcasting. |
|---|
| Источник | ⚠️ https://github.com/OpenBMB/IoA/issues/20 |
|---|
| Пользователь | Evo1ution (UID 101872) |
|---|
| Представление | 14.10.2026 15:41 (23 дни назад) |
|---|
| Модерация | 06.11.2026 17:59 (23 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 432019 [OpenBMB Internet of Agents до 9d78e88e47160eb42ee1ee8538c05e1c2c47877a Message im_server/app.py fetch_chat_record comm_id эскалация привилегий] |
|---|
| Баллы | 20 |
|---|