| 标题 | https://github.com/OpenHands OpenHands 1.20.0 Local Sensitive Logic Exposure leading to Remote Code Execution |
|---|
| 描述 | The OpenHands Agent Canvas desktop client (Electron) launches four local services at startup: the ingress reverse proxy (default port 8000), the static frontend server (port 3001), the Agent Server (127.0.0.1:18000, loopback only) and the Automation backend (127.0.0.1:18001, loopback only).
On the default startup path, the client bakes the 32-byte Session API Key in plaintext into the landing page HTML — as window.__AGENT_CANVAS_SESSION_API_KEY__ — so that the user "never has to paste it". That landing page is served with no authentication whatsoever, and both services hosting it bind to all network interfaces (::, functionally equivalent to x.x.x.x).
The disclosed key is not a low-privilege token: it is identical to the Agent Server's OH_SESSION_API_KEYS_0, i.e. it carries the full Agent Server API surface, command execution included. It is additionally reused as the Automation administrator key (AUTOMATION_LOCAL_API_KEY) and the KV-store encryption key (AUTOMATION_KV_SECRET) — a master key for the whole local service stack.
The affected behavior includes:
Any LAN host can steal the Session API Key with a single unauthenticated GET http://<victim>:8000/ — and also directly via :3001, bypassing the ingress entirely.
Any LAN host can execute arbitrary commands on the victim's machine (POST /api/bash/execute_bash_command) — remote code execution with the privileges of the logged-in user.
Any LAN host can read arbitrary absolute file paths, including sensitive files under the user's home directory (GET /api/file/...).
Any LAN host can read the global configuration (GET /api/settings).
Any LAN host can read stored LLM / third-party service credentials in plaintext (GET /api/settings/secrets/{name}).
Any LAN host can list and read all conversation history (GET /api/conversations).
Control experiment: the same command-execution endpoint returns HTTP 401 when the key is not supplied. The authentication mechanism itself is sound — the only defect is that the credential is published, unauthenticated, inside the landing page HTML. The "this is intended behaviour" defence therefore does not apply.
The whole chain was reproduced end-to-end against the real Electron desktop client (see Section 4). CVSS 3.1: 8.8 (High) — AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. |
|---|
| 来源 | ⚠️ https://github.com/OpenHands/OpenHands/issues/17878 |
|---|
| 用户 | PoriaMs (UID 101188) |
|---|
| 提交 | 2026-10-14 04時04分 (22 日前) |
|---|
| 管理 | 2026-11-04 21時53分 (22 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 431199 [OpenHands 直到 1.24.0 Landing Page 弱身份验证] |
|---|
| 积分 | 20 |
|---|