Submit #1011581: iFlytek astron-agent v1.1.2, main b4f8ed57460cbfb32016a4afd3fd7212987d33c3 Incomplete List of Disallowed Inputs

A vulnerability was found in iFlytek astron-agent up to v1.1.2 (main commit b4f8ed57460cbfb32016a4afd3fd7212987d33c3 tested). The affected component is the DDL whitelist of the core-database service at POST /xingchen-db/v1/exec_ddl (core/memory/database/api/v1/exec_ddl.py:60-80).

For statements that SQLGlot 26.29.0 models as exp.Command (for example CREATE EXTENSION), the whitelist resolves the statement type by running re.search(r"\bALTER\s+TABLE\b", sql) against the original SQL string instead of the parsed statement. SQLGlot 26.29.0 preserves comments when it re-serializes a parsed command, so a comment containing the allowlisted keyword satisfies the guard while the statement itself remains the rejected command: "/* ALTER TABLE */ CREATE EXTENSION IF NOT EXISTS dblink" passes the whitelist and executes. The bare statement without the comment is correctly rejected with code 25040 (DDL syntax not allowed), because SQLGlot 26.29.0 types it as Command with key "command".

The /xingchen-db/v1 routers are mounted without request authentication (core/memory/database/main.py:114); each route validates only a database_id/uid pair that the caller mints itself through the equally unauthenticated create_database route. In the stock docker-compose deployment the service connects to PostgreSQL with the shipped spark role, which the official postgres image creates as a superuser.

Observed on a local docker-compose deployment of the tested commit: the bare CREATE EXTENSION IF NOT EXISTS dblink statement was rejected with code 25040; the identical statement prefixed with /* ALTER TABLE */ was accepted (code 0) and the dblink extension was installed in the caller's own test database, confirmed via \dx. The only difference between the accepted and rejected statements is the comment.

Impact: a PostgreSQL command that the DDL whitelist exists to reject is executed by the service. The demonstrated impact ends at extension installation in a caller-created test database. File reading, cross-schema access and code execution were NOT demonstrated and are not claimed. The stock docker-compose and Helm definitions do not publish port 7990 to the host, so the realistic attack surface is peers on the internal Docker/Kubernetes network or deployments that explicitly publish the port.

Earlier releases were not exhaustively checked. No fix was available at submission time.

Proof of Concept (inert, self-cleaning, authorisation-gated):
https://github.com/Rinne666/poc/tree/main/astron-agent-poc/poc/v1_ddl_whitelist_comment_smuggling.py

Full report, evidence and environment guide:
https://github.com/Rinne666/poc/tree/main/astron-agent-poc

Reference: https://github.com/iflytek/astron-agent

• Source: ⚠️ https://github.com/Rinne666/poc/tree/main/astron-agent-poc
• User: qyf20051010 (UID 100545)
• Submission: 10/02/2026 14:41 (1 month ago)
• Moderation: 10/26/2026 07:40 (24 days later)
• Status: Accepted
• VulDB entry: 426314 [iFlytek astron-agent up to 1.1.2 DDL Whitelist exec_ddl.py incomplete blacklist]
• Points: 20