提交 #865114: HKUDS nanobot 0.2.1 Command Injection via Comment-Tail Allowlist Bypass (CWE-88)

# Technical Details
A comment-tail allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.

The application fails to account for POSIX shell comment semantics when enforcing `exec.allow_patterns`. It approves the raw command string if an allowlisted token appears anywhere, including after `#`, and then executes the same string through the shell. A payload like `touch "/path/to/comment-tail-canary" # echo allowlisted` therefore passes the regex guard while the shell ignores the comment tail and executes only the malicious pre-comment payload.

# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: `_guard_command()` matches `allow_patterns` against the entire raw string with `re.search()`, but `_spawn()` later invokes `bash -c`, where the `# ...` suffix is discarded as a comment and the attacker-controlled `touch` command still runs.

# Reproduction
1. Enable `ExecTool` on nanobot 0.2.1 with `allow_patterns=[r"\becho\s+allowlisted\b"]` and `restrict_to_workspace=True`.
2. Trigger the command `touch "<canary>" # echo allowlisted` through the real `ToolRegistry` or provided PoC.
3. Observe that the command is accepted and the canary file is created, while a plain `touch "<canary>"` control case is blocked.

# Impact
- An attacker can execute unintended shell commands while making the raw command text appear to satisfy the operator allowlist.
- Workspace files, scripts, and sensitive material can be modified or harvested from the nanobot runtime context.

• 来源: ⚠️ https://gist.github.com/YLChen-007/f491f368cabe21a832ee3da29437de18
• 用户: Eric-c (UID 96848)
• 提交: 2026-06-22 04時17分 (2 月前)
• 管理: 2026-08-07 14時07分 (2 months later)
• 状态: 重复
• VulDB条目: 386997 [HKUDS nanobot 直到 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn 权限提升]
• 积分: 0