提交 #862546: nearai IronClaw 0.29.1 Improper Authorization (CWE-285)

# Technical Details
A Shell Approval Boundary Bypass via `env /bin/sh -c` Wrapper exists in the command risk classifier in `src/tools/builtin/shell.rs` of IronClaw.

The application classifies command risk by the visible outer token and does not unwrap transparent shell dispatch wrappers. A destructive payload wrapped as `env /bin/sh -c 'chmod 777 /tmp/demo'` is classified from `env`, not from the inner `chmod 777`. The classifier returns `RiskLevel::Medium`, which maps to `ApprovalRequirement::UnlessAutoApproved`. When `shell` has been previously auto-approved in the session, the wrapped destructive command bypasses the per-invocation check and executes through `sh -c`. Direct destructive commands still hit the `Always` floor.

# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: classify_command_risk() — classifies from outer token `env` without unwrapping `/bin/sh -c`; ShellTool::requires_approval() maps both Low and Medium to UnlessAutoApproved
File: src/agent/dispatcher.rs and src/agent/thread_ops.rs
Method: Approval logic skips UnlessAutoApproved when session has auto-approved shell, preserving Always only as the per-call floor
Why: The outer-to-inner wrapper chain is invisible to the prefix classifier, and the approval model trusts the misclassified risk level. Once shell is auto-approved, any UnlessAutoApproved command executes without re-confirmation.

# Reproduction
1. In an IronClaw session with `shell` previously auto-approved, send: `env /bin/sh -c 'chmod 777 /tmp/demo'`.
2. Observe the command is classified as `Medium`, maps to `UnlessAutoApproved`, and skips the fresh approval.
3. Confirm the direct `chmod 777 /tmp/demo` is classified as `High`, maps to `Always`, and still requires approval.

# Impact
- Approval bypass allowing destructive shell behavior (permission changes, file operations) without the intended second approval step.
- Malicious prompt content or prompt-injected context can hide destructive commands behind transparent wrappers.
- Follow-on shell command execution within IronClaw runtime privileges or sandbox/container context.

• 来源: ⚠️ https://github.com/nearai/ironclaw/issues/4865
• 用户: Erichen-apple (UID 99087)
• 提交: 2026-06-18 08時42分 (2 月前)
• 管理: 2026-08-05 18時46分 (2 months later)
• 状态: 重复
• VulDB条目: 386265 [nearai ironclaw 直到 0.29.1 shell.rs classify_command_risk 权限提升]
• 积分: 0