| tiêu đề | cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285) |
|---|
| Mô tả | # Technical Details
An Improper Authorization vulnerability exists in Mercury Agent's `run_command` shell permission classifier. In `src/capabilities/permissions.ts`, the `SAFE_READ_PATTERNS` list includes a broad `find *` rule, and `checkShellCommand()` auto-approves any command where every parsed shell segment matches one of these patterns. However, `find` is not a purely read-only command — it supports action-bearing flags such as `-exec`, `-execdir`, `-ok`, `-okdir`, and `-delete`. Mercury does not deny or special-case these flags before approval. Once approved, `run_command` forwards the original command string directly to `spawn(command, [], { shell: true })` in `src/capabilities/shell/run-command.ts`, allowing a `find -exec sh -c '...'` payload to launch an arbitrary subprocess without the expected approval prompt.
# Vulnerable Code
File: src/capabilities/permissions.ts (lines 450-509)
Method: PermissionManager.checkShellCommand() / SAFE_READ_PATTERNS
Why: `find *` is in the safe-read allowlist, and `checkShellCommand()` auto-approves any matching segment without rejecting dangerous `find` action flags such as `-exec`.
File: src/capabilities/shell/run-command.ts (lines 97-108)
Method: run_command tool handler / executeCommand()
Why: `run_command` accepts the approval result from `checkShellCommand()` and then executes the original command string through `spawn(..., { shell: true })` without further validation.
File: src/web/api/chat.ts (lines 110-123)
Method: Chat API endpoint / POST /api/chat/send
Why: Mercury Web's authenticated chat endpoint forwards user-controlled content into the normal agent execution loop that can trigger `run_command`.
# Reproduction
1. Authenticate to Mercury web dashboard.
2. Send a chat prompt causing the model to invoke `run_command` with `find . -maxdepth 0 -exec sh -c 'printf CVE-2026-22169-vuln-canary > canary-vuln.txt' ';'`.
3. Observe no `permission_request` event; the command is logged as "Shell command auto-approved (safe read-only)".
4. Confirm `canary-vuln.txt` was created with the expected canary content.
5. Verify the control path (direct `sh -c '...'` payload) triggers a `permission_request` and does not execute.
# Impact
- Authorization / approval-bypass turning a user-confirmation boundary into silent local command execution.
- Any authenticated Mercury Web user can achieve host command execution without the expected approval prompt.
- Access to Mercury process user's local repository contents, working files, and other assets. |
|---|
| Nguồn | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/71 |
|---|
| Người dùng | TrumpChen (UID 99092) |
|---|
| Đệ trình | 18/06/2026 09:54 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 05/08/2026 23:25 (2 months later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 386379 [cosmicstack-labs mercury-agent đến 1.1.12 run_command permissions.ts PermissionManager.checkShellCommand nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|