| Название | qwibitai nanoclaw 2.0.64 Improper Privilege Management (CWE-269) |
|---|
| Описание | # Technical Details
An Improper Privilege Management vulnerability exists in NanoClaw's host-side `create_agent` path. In `src/modules/agent-to-agent/create-agent.ts`, `handleCreateAgent()` directly performs privileged child-agent creation after receiving a system action, without a sender-level owner/admin authorization check. A non-owner member who can chat with an owner-initialized agent group can trigger this path through the normal container MCP tool `create_agent` (in `container/agent-runner/src/mcp-tools/agents.ts`), which writes a system action to `messages_out`. The host-side `src/delivery.ts` consumes that system message and forwards it to the handler. The access model in `src/modules/permissions/access.ts` explicitly allows ordinary members to interact with agent groups, making the path reachable in practice. Owner-initialized groups also get elevated `cli_scope='global'` by default in `scripts/init-first-agent.ts`.
# Vulnerable Code
File: src/modules/agent-to-agent/create-agent.ts (lines 37-85)
Method: handleCreateAgent()
Why: Receives the host-side `create_agent` system action and directly executes privileged child-agent creation without a sender-level owner/admin authorization check.
File: src/modules/permissions/access.ts (lines 21-27)
Method: canAccessAgentGroup()
Why: The access model explicitly allows a normal `member` to interact with the agent group, enabling non-owner traffic to legitimately enter the target session.
File: container/agent-runner/src/mcp-tools/agents.ts (lines 31-63)
Method: create_agent MCP tool
Why: The container tool emits a `create_agent` system action into `messages_out`; the host is expected to re-authorize this action instead of trusting container reachability.
# Reproduction
1. Deploy NanoClaw with an owner-initialized agent group and a non-owner member who can chat with it.
2. The non-owner member sends a message that reaches the shared owner agent session.
3. The agent emits a `create_agent` system action via the container MCP tool.
4. The host-side handler creates the new child agent immediately with `approvalsCount=0`.
5. Confirm the control case (non-global `cli_scope`) produces an approval request instead.
# Impact
- Privilege escalation / authorization bypass on a host-side system action.
- Non-owner member can create persistent child agent groups without owner/admin approval.
- Changes central database state (`agent_groups`, destinations, configuration inheritance) and initializes new host-side workspace content.
- Expands attacker's reachable execution surface and bypasses the intended approval boundary. |
|---|
| Источник | ⚠️ https://github.com/nanocoai/nanoclaw/issues/2807 |
|---|
| Пользователь | TrumpChen (UID 99092) |
|---|
| Представление | 18.06.2026 09:54 (2 месяцы назад) |
|---|
| Модерация | 05.08.2026 21:51 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 386386 [nanocoai NanoClaw до 2.0.64 Child-Agent Creation create-agent.ts handleCreateAgent эскалация привилегий] |
|---|
| Баллы | 20 |
|---|