Listen to this Post
The vulnerability exists in the `run_ssh_command_with_credentials()` function tool used by AI agents. This function constructs an SSH command string using user inputs for host, username, password, command, and port. Only the password and command inputs are escaped with single quotes to prevent shell injection, using replace("'", "'\\''"). However, the username, host, and port parameters are directly interpolated into the shell command without proper sanitization. An attacker can craft malicious values for these unescaped inputs, such as the username, to inject arbitrary shell commands. In the Proof of Concept, the username contains a shell command substitution: root$(echo pwned > /tmp/username). When the function builds the SSH command, this injection becomes part of the shell command executed via run_command(ssh_command). Since the username is not escaped, the embedded `$(echo pwned > /tmp/username)` is executed on the host running the CAI framework before the SSH connection is attempted. This allows command execution on the local system with the privileges of the CAI process, typically leading to full compromise. The vulnerability is triggered when an AI agent retrieves and uses attacker-controlled credentials from a source like a malicious webpage.
Platform: CAI Framework
Version: Unspecified
Vulnerability: Command Injection
Severity: Critical
date: Not disclosed
Prediction: Patch expected soon
What Undercode Say:
Analytics
ssh_command construction:
sshpass -p 'escaped_password' ssh -o StrictHostKeyChecking=no username@host -p port 'escaped_command'
Injection via username:
username = "root$(malicious_command)"
Code flaw:
Missing escaping for username, host, port
ssh_command = f"sshpass -p '{escaped_password}' ssh -o StrictHostKeyChecking=no {username}@{host} -p {port} '{escaped_command}'"
How Exploit
Serve malicious HTML:
username: `root$(id > /tmp/pwn)`
Agent fetches credentials.
Executes `run_ssh_command_with_credentials`.
Command injection via username.
Protection from this CVE
Escape all inputs.
Use parameterized execution.
Input validation.
Impact
Remote code execution.
Host compromise.
Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
