| tiêu đề | princezuda safestclaw 4.2.4 Incomplete List of Disallowed Inputs (CWE-184) |
|---|
| Mô tả | # Technical Details
A shell allowlist bypass exists in the `ShellAction._validate_command()` method in `src/safestclaw/actions/shell.py` of safestclaw.
The application tokenizes the user-supplied command with `shlex.split()` and validates only the basename of `args[0]`. Because `env` is in `DEFAULT_ALLOWED`, a command such as `env bash -c id` passes validation even though `bash` is not allowlisted. The code never inspects or re-binds policy to the effective inner executable, so `ShellAction.execute()` passes the full attacker-controlled argv to `asyncio.create_subprocess_exec(*args)`.
# Vulnerable Code
File: src/safestclaw/actions/shell.py
Method: _validate_command()
Why: The method validates only `Path(args[0]).name` against the allowlist, so `env bash -c id` is approved based on `env` alone. The effective inner executable (`bash`) is never checked.
# Reproduction
1. Start the SafeClaw web server on the 4.2.4 release.
2. Send `POST /api/message {"text":"shell env bash -c id"}` to the built-in web interface.
3. Observe the response returns `uid=0(root) gid=0(root) groups=0(root)`.
4. Send the control command `POST /api/message {"text":"shell bash -c id"}`.
5. Observe the control returns `Command blocked: Command not allowed: bash`.
# Impact
- Bypasses the built-in shell executable allowlist.
- Attackers can execute denied interpreters by wrapping them with `env`.
- Code runs with SafeClaw process privileges, granting access to files, environment variables, and network resources. |
|---|
| Nguồn | ⚠️ https://github.com/princezuda/safestclaw/issues/59 |
|---|
| Người dùng | Eric-x (UID 94869) |
|---|
| Đệ trình | 12/06/2026 11:52 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 17/07/2026 18:13 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 379845 [princezuda SafestClaw đến 4.2.4 Built-in Web Interface shell.py ShellAction._validate_command nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|