praisonaiaagents AgentServer auth_token Bypass Vulnerability (CVE-2024-55328)

漏洞概述 praisonaiaagents: AgentServer 声明了 auth_token 但从未在任何路由上强制执行 (CWE-862) CVE ID: CVE-2024-55328 CVSS 3.1 8.2 (High) Affected versions: = 1.6.58 Severity: High TL;DR AgentServer.ServerConfig 声明了一个 auth_token: Optional[str] = None 字段，当操作员想要锁定服务器时，他们会设置这个字段。GET /info 端点最终会显示它作为 "auth_token": "**" —— 强烈暗示该值已嵌入到请求身份验证中。 然而，AgentServer._create_app 不仅读取 auth_token，还从不添加身份验证中间件，也不装饰任何带有检查身份验证的路由。所有路由 —— /info、/publish、/events、/health —— 都接受未经身份验证的请求，无论是否配置了 auth_token。 同一包中包含一个兄弟服务器 praisonaiaagents.ui.a2a.A2A，由同一开发人员编写，它正确地通过 FastAPIs Depends(_verify_auth) 实现了 bearer-token 模式。这排除了“auth 尚未实现”的可能性：操作员期望添加身份验证；开发人员知道该模式，但没有将其应用于 AgentServer。 Root cause Sibling proof — the same package gets it right elsewhere That is the missing implementation. Porting it to AgentServer — either via Starlette BaseHTTPMiddleware or by switching to FastAPI and adding Depends(_verify_auth) to each route — closes the gap. Affected routes (empirically tested) Impact The /publish and /events routes are the load-bearing ones. Together they let an unauthenticated network-adjacent attacker: 1. Inject control events into every agent process subscribed to the server. AgentServer.broadcast(event_type, data) puts the payload into every SSEClient.queue; any consumer dispatching on event_type will dispatch on the attacker-chosen type. Real deployments register handlers per event type via AgentServer.on_event(...); an attacker who can guess (or enumerate via /info + inspection) a registered type can drive arbitrary handler invocations with attacker-chosen data. 2. Eavesdrop on the entire event bus by subscribing to /events. Whatever the legitimate publishers send is visible: agent interactions, intermediate plans, tool inputs and outputs, user-supplied prompts that the operator believed were behind the auth_token wall. 3. Pivot via leaked config. /info is sufficient to enumerate cors_origins (helping plan cross-origin attacks if any of the listed origins are attacker-controlled) and to confirm that the target has bothered to set auth_token, signalling a high-value target. SSEClient.queue is a queue.Queue with no documented size cap; the event broadcaster does not check max_connections against broadcasts (CWE-770). Not scored as the main impact above. Anchors praisonaiaagents 1.6.48, file praisonaiaagents/server/server.py: Source sha250 (1.6.48, praisonaiaagents/server/server.py): aacc407d1515c62928b7027d690e113f3b53769644d5efee9550534ca7e4 (9.962 bytes). Sibling (same package, same field name, enforced): praisonaiaagents/ui/a2a/a2a.py:103-110. Reproduction (empirical PoC) poc/poc.py starts AgentServer with ServerConfig(auth_token="super-secret-not-actually-checked"), and then sends unauthenticated requests to each route. Run log (poc/run-log.txt): Suggested fix Make AgentServer reuse the A2A pattern. Smallest fix: Constant-time comparison (hmac.compare_digest) is appropriate since this is a network-comparable secret. Steps to reproduce 1. Clone the target: 2. Run the proof of concept (poc.py) against the cloned source. 3. Observe the result shown under Verified result below. Proof of concept Verification harness (executed against the cloned repo) This drives the unmodified upstream code rather than a reproduction. Verified result This PoC was executed against the live upstream code; captured output: Credit Kai Aizen — SnailSplit (@SnailSplit), Adversarial & Offensive Security Research.

目標達成すべての支援者に感謝 — 100%達成しました！

praisonaiaagents AgentServer auth_token Bypass Vulnerability (CVE-2024-55328)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

praisonaiaagents AgentServer auth_token Bypass Vulnerability (CVE-2024-55328)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！