| Title | https://github.com/BlackBeltTechnology/pi-agent-dashboard pi-agent-dashboard 0.8.0 Local Sensitive Logic Exposure leading to Command Excution |
|---|
| Description | pi-agent-dashboard starts a local Fastify server on 127.0.0.1:8000 (default install: Electron desktop app, standalone mode, or pi-dashboard CLI). The same HTTP listener serves the REST API and three WebSocket gateways: /ws (browser gateway), /ws/terminal/<id> (PTY terminals) and /live/<id>.
When no OAuth provider is configured (the default state — /auth/status reports authEnabled:false), the WebSocket upgrade gate authorizes a connection only by checking that the TCP peer address is loopback. There is no Origin check, no CSRF token, and no local-IPC token requirement on this path.
Because the WebSocket handshake is a plain HTTP GET Upgrade — not subject to CORS preflight, and not covered by the browser same-origin policy for subsequent WS traffic — any website opened in the victim's browser can dial ws://127.0.0.1:8000/ws. The browser opens that TCP connection from the victim's own machine, so the server sees a loopback peer and admits the attacker's page.
The affected behavior includes:
Any web Origin can open the browser gateway WebSocket /ws with no authentication.
Every new connection immediately receives the sessions_snapshot broadcast: every session's id, name, cwd and status — disclosure of all working directories and agent session state.
A page can send {"type":"create_terminal","cwd":"C:\\Users\\Public"}; the server spawns a real PTY (cmd.exe via %COMSPEC% on Windows, $SHELL on unix) with no authorization check.
The terminal_added broadcast discloses the new terminal id; the page then connects ws://127.0.0.1:8000/ws/terminal/<id> (same loopback-only gate) and every binary WebSocket frame is written verbatim into the PTY — a fully interactive shell, arbitrary command execution as the desktop user.
Other high-impact browser-gateway messages reachable the same way: send_prompt (inject arbitrary prompts into live agent sessions — agents hold shell tools), spawn_session, kill_process, force_kill.
Additionally, REST mutations that read no JSON body (e.g. POST /api/tunnel-connect, POST /api/tunnel-disconnect, POST /api/pi-core/update) can be triggered cross-site as blind CSRF: CORS gates only the reading of responses, never the delivery of simple requests.
Severity: Critical — CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6). Attacker requirements are minimal: the victim only needs the dashboard running and to open one attacker-controlled web page (no click required; the page can auto-run on load).
Affected version: v0.8.0 (current release) and earlier, in the default configuration (no OAuth provider configured). Verified on the Electron desktop app (Windows x64) and the npm CLI layout.
please creadit huan & song |
|---|
| Source | ⚠️ https://github.com/BlackBeltTechnology/pi-agent-dashboard/issues/625#issuecomment-5641349847 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/03/2026 16:56 (15 days ago) |
|---|
| Moderation | 10/18/2026 19:28 (15 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 421967 [BlackBeltTechnology pi-agent-dashboard up to 0.8.0 WebSocket Gateway cwd origin validation] |
|---|
| Points | 20 |
|---|