AstrBot Persona Tool Policy Bypass Vulnerability Analysis

Vulnerability Overview Title: [Security] Persona Policy Bypass Re-Exposes Built-in Web Search Tools in AstrBot #8780 Description: The persona-level tool policy in AstrBot can be bypassed during the main agent construction. Personas explicitly configured with should disable all tools; however, the final tool list is modified after persona filtering. When , the main agent appends and related built-in tools even after the persona allowlist has been applied. Consequently, an authenticated operator can bind a conversation with a seemingly tool-less persona to the HTTP interface, which still triggers the exposure and invocation of real tools. Details: The vulnerability resides in the tool assembly logic within . Persona restrictions are first converted into and merged into . At this stage, a persona with correctly returns an empty tool set. The issue lies in subsequent paths that directly append built-in tools to without re-applying the persona restrictions. One such path involves the web search assistant: This assistant is invoked after persona filtering. There are other post-filtering append paths, including proactive messaging: Scope Ecosystem: GitHub Package Name: AstrBot Affected Versions: < 4.25.5 Fixed Version: Not provided Severity: Medium Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Weakness: CWE: CWE-863: Incorrect Authorization Remediation After all tools have been added in (including , , and ), add a step to re-filter the persona tool whitelist. For example, after line 1539, if the persona has an explicit list configured, perform a final intersection filter on . POC Code Prerequisites: AstrBot deployed using the official AstrBotDevs/AstrBot repository. An authenticated Dashboard/operator account with permissions to create personas, bind personas to conversations, and edit runtime configurations. Access to an OpenAI-compatible backend. The provided POC uses a local mock provider at . AstrBot launched with the provided runtime template and an enabled Dashboard at . Reproduction Steps: 1. Download the mock provider script from . 2. Download the main exploitation script from . 3. Download the control script from . 4. Download the runtime configuration template from . 5. Place all four files in the same working directory and run the control script: 6. Confirm that the control output ends with and . 7. Run the exploitation script: 8. Check and . 9. Confirm that the array output contains , and that the AstrBot runtime log records , even though the bound persona was created with . Log Evidence: The final line is generated by a bug in the POC summary, not a true exploitation result. The definitive runtime evidence is: The original provider capture shows the prohibited tools being exposed to the model: Conclusion This vulnerability is a policy enforcement bypass that defeats the security intent of persona-level tool disabling. Any deployment relying on to create tool-less personas may inadvertently re-expose built-in tools when optional features are enabled. In the validated path, web search becomes available despite the operator explicitly disabling all tools. In broader code paths, the same design flaw can re-expose proactive messaging, cron-related tools, and local sandbox computer-use tools if these late-attached features are enabled. This breaks operator expectations and may expand the operations the model is permitted to perform within the boundaries of conversations intended to be tool-less.

Goal Reached Thanks to every supporter — we hit 100%!

AstrBot Persona Tool Policy Bypass Vulnerability Analysis

More from this source