提交 #1033599: OpenBMB Internet of Agents(IoA) 9d78e88 Code Injection

A vulnerability was found in OpenBMB Internet of Agents up to commit 9d78e88. It has been declared as critical. This vulnerability affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. The manipulation of the argument filename/lang leads to code injection. It is possible to launch the attack remotely.

Details: the execute_code tool states in its docstring that it executes code in a docker container, but it actually runs a local subprocess in the current process without any sandbox, chroot, privilege drop, or resource limits. The filename argument is concatenated with os.path.join(work_dir, filename) without sanitization, so "../" escapes the extensions directory and writes arbitrary files; passing code=None executes an existing file. The lang argument maps bash/sh/shell/powershell to local shells.

Attack flow: a malicious agent joins a team (trivial via the unauthenticated registration) and, in the course of normal collaboration, induces the victim agent's LLM to call execute_code; the supplied code then runs with the victim agent's process privileges. In the provided Docker orchestration the tool-agent containers run privileged and mount /var/run/docker.sock, which escalates this to host-level control.

Proof of concept (direct invocation of the real tool code): (1) execute_code(code="import os, sys; print(os.getlogin(), os.getpid(), sys.executable)", lang="python") prints the host OS user and the local Python interpreter path, proving execution outside any container; (2) execute_code(code="echo pwned", lang="bash") executes a local shell; (3) execute_code(code="written by path traversal", filename="../poc/PWNED_traversal.txt") writes a file outside the extensions directory; (4) a single call can allocate 256MB of memory without any limit.

Impact: arbitrary python/bash/sh/powershell code executes with the agent process privileges, arbitrary-path file writes are possible, and memory/CPU can be exhausted; combined with the privileged tool containers it escalates to host-level command execution.

Suggested fix: execute code in a real non-privileged container with no host mounts and no network by default; accept basenames only for filename and restrict extensions; enforce memory/CPU/process/timeout limits; disable shell languages by default and require explicit authorization; remove privileged=True and the /var/run/docker.sock mount from the tool-agent containers.

• 来源: ⚠️ https://github.com/OpenBMB/IoA/issues/18
• 用户: Evo1ution (UID 101872)
• 提交: 2026-10-14 14時47分 (23 日前)
• 管理: 2026-11-06 10時37分 (23 days later)
• 状态: 已接受
• VulDB条目: 431792 [OpenBMB Internet of Agents 直到 9d78e88e47160eb42ee1ee8538c05e1c2c47877a Code Executor Tool code_executor.py execute_code filename/lang 权限提升]
• 积分: 20