提交 #865121: HKUDS nanobot 0.2.1 Command Injection via Shell-Chain Allowlist Bypass (CWE-88)

# Technical Details
A shell-chain allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.

The application fails to enforce `tools.exec.allowPatterns` on the full effective shell behavior. It lowercases the raw command string, approves it if a loose pattern like `\\becho\\s+allowlisted\\b` matches anywhere, and then executes the same string with `bash -c`. A payload such as `echo allowlisted && touch /workspace/canary-created` therefore inherits approval from its first segment and still executes the appended command.

# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: The allowlist logic is substring-based and shell-unaware, while the execution path is shell-aware. That check/execute mismatch lets `&&` or other shell separators smuggle unauthorized commands past the policy boundary.

# Reproduction
1. Run the provided end-to-end lab for nanobot 0.2.1 with a vulnerable config using `allowPatterns: ["\\becho\\s+allowlisted\\b"]` and a fake provider that triggers the `exec` tool.
2. Send the command `echo allowlisted && touch "<canary-path>"` through the real OpenAI-compatible service flow.
3. Observe that the vulnerable workspace contains `canary-created`, while the control instance using `^echo\\s+allowlisted$` records an allowlist error and does not create its canary.

# Impact
- An attacker who can induce an `exec` tool call can execute unintended shell commands under the nanobot process account.
- Files in the agent workspace can be created, modified, or deleted, enabling follow-on tampering or broader compromise where stronger isolation is absent.

• 来源: ⚠️ https://gist.github.com/YLChen-007/da7ee2c191ffbfa46ccd12ee66f5bf85
• 用户: Eric-c (UID 96848)
• 提交: 2026-06-22 04時28分 (3 月前)
• 管理: 2026-08-07 14時07分 (2 months later)
• 状态: 重复
• VulDB条目: 386997 [HKUDS nanobot 直到 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn 权限提升]
• 积分: 0