GHSA-5wp8-q9mx-8jx8: zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with cargo audit.
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary zeptoclaw implements a allowlist combined with a blocklist to prevent malicious shell commands in src/security/shell.rs. However, even in the Strict mode, attackers can completely bypass all the guards from allowlist and blocklist:

- to bypass the allowlist, command injection is enough, such as ;, $() etc. - to bypass the REGEXBLOCKEDPATTERNS, argument injection is enough, such as the python3 -P -c "..." - to bypass the LITERALBLOCKEDPATTERNS, file name wildcards can do the work, such as cat /etc/pass[w]d

Details In code src/security/shell.rs#L218-L243, one can see the allowlist only checks the first token and thus makes command injection possible.

!self.allowlist.isempty() makes the empty allowlist overlook the allowlist check, if it is in ShellAllowlistMode::Strict mode, empty allowlist should direct reject all the commands.

As the code in src/security/shell.rs#L18-L70, we can find the REGEXBLOCKEDPATTERNS only apply \s+ in between the command and arguments, making argument injection possible, and the LITERALBLOCKEDPATTERNS just uses specific file name, totally overlooking the file name wildcards:

PoC

Impact Unauthorized command execution.

Credit @zpbrent

CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sources and references

1. GitHub Advisory GHSA-5wp8-q9mx-8jx8 github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical crates.io (Rust) advisories · Today’s Security Digest