| tiêu đề | TinyAGI tinyagi 0.0.20 Missing Authorization (CWE-862) |
|---|
| Mô tả | # Technical Details
A Missing Authorization vulnerability exists in TinyAGI's Anthropic execution path. The public `POST /api/message` endpoint in `packages/server/src/routes/messages.ts` accepts unauthenticated attacker input and enqueues it via `enqueueMessage()`. The queue processor in `packages/main/src/index.ts` then passes the message into `invokeAgent()` without any local permission gate. The Claude provider adapter in `packages/core/src/adapters/claude.ts` initializes the CLI subprocess arguments with `--dangerously-skip-permissions` by default before appending the attacker-controlled prompt with `-p <message>`. This flag disables Claude's provider-side permission approval barrier for tool usage. The source-to-sink chain is: `POST /api/message` → `enqueueMessage()` → SQLite queue → `processMessage()` → `invokeAgent()` → `claude --dangerously-skip-permissions -p <message>`.
# Vulnerable Code
File: packages/server/src/routes/messages.ts (lines 7-16)
Method: POST /api/message handler
Why: Public unauthenticated HTTP entrypoint that accepts attacker-controlled `message` content.
File: packages/core/src/adapters/claude.ts (lines 27-43)
Method: Claude adapter invoke()
Why: Initializes the CLI argument list with `--dangerously-skip-permissions` before appending the attacker-controlled prompt.
File: packages/main/src/index.ts (lines 98-109)
Method: processMessage()
Why: Forwards the queued message into `invokeAgent(...)`, which drives the provider adapter on behalf of the external caller.
# Reproduction
1. Start TinyAGI daemon with a Claude provider configured.
2. Send `POST /api/message` with attacker-controlled prompt content via a PATH shim that captures subprocess argv.
3. Inspect captured sink arguments — confirm `--dangerously-skip-permissions` is present.
4. Run matched control: strip only `--dangerously-skip-permissions` flag, confirm control `captured-control.json` lacks the flag.
5. Observe that the same HTTP entrypoint and queue path are preserved in both cases.
# Impact
- Network-reachable permission-bypass in the default Anthropic execution path.
- Attacker-controlled prompts reach Claude in pre-approved mode, skipping provider-side permission approvals.
- Weakens the last safety barrier for high-risk tool use (local files, command execution, plugins).
- Exposes host running TinyAGI, agent workspace, project files, cached secrets, and reachable systems. |
|---|
| Nguồn | ⚠️ https://github.com/TinyAGI/tinyagi/issues/284 |
|---|
| Người dùng | JondaChen (UID 99096) |
|---|
| Đệ trình | 18/06/2026 10:48 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 05/08/2026 22:20 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 386403 [TinyAGI 0.0.20 Message API Endpoint index.ts processMessage nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|