ClaudeHookBridge Deny Pattern Bypass via Multi-field Inspection

Vulnerability Overview Vulnerability Name: ClaudeHookBridge deny/allow gate inspects only the first candidate field, bypassing deny patterns via non-first fields Vulnerability Description: Vulnerability Type: Security Bypass Affected Versions: Fixed Version: Vulnerability Details: Vulnerability Principle: The function, when processing , only checks the first candidate field instead of all candidate fields. This allows attackers to bypass security restrictions via non-first fields. Specific Implementation: - The function is defined in and serves as the sole hardcoded checkpoint by default. - This function returns the first matching field; if no match is found, it returns . - For operations, the field is always present and takes priority in matching, causing other fields (such as ) to be incorrectly checked. Impact Scope Impact Level: High CVSS Score: 8.4 / 10 Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High Specific Impact: Attackers can bypass explicit hard deny controls enforced by operators to execute any tool carrying executable or dangerous content. For MCP execution tools and Write/Edit operations, this can lead to RCE-like impacts, such as writing web shells or executing fetched scripts. Remediation Remediation Suggestions: Fixed Version: Remediation Measures: - The function should match against all candidate fields, not just the first one. - Alternatively, should be applied unconditionally to all fields, not just the first one. Fixed Code: POC Code POC Code: Attack Chain: 1. Entry Point: The operator has deployed the default enforce/observe hook configuration. The hook uses to block dangerous commands. 2. Action: A prompt-injected agent calls the multi-field tool , containing and . 3. Bypass: - In observe mode, the call is allowed (deny is the only hard block); in enforce mode, AuthGuardian scores the benign target and allows bypass, never checking the dangerous field. 4. Sinkhole: The MCP server executes the parameter, or a web shell is written to a file - Guards: none remaining (deny was bypassed). 5. Impact: Complete bypass of operator hard deny controls, allowing any tool carrying executable content - RCE-like. Bypass Evidence: returns the first candidate field. For and , the matched string is (deny miss); for , the matched string is - the content is never checked. Remediation Verification: The fix for GHSA-743h-jr5x-mspc (commit 1204033) only removed the truncation and added - the field selection loop with remains byte-identical to the pre-fix state. This is a different, unpatched axis - an INCOMPLETE fix for the same deny-gate control, not a duplication of the truncation bug. Affected Versions: - Claude Code hooks were introduced in v5.14.0 (commit 1775ad), affecting the byte-identical tag (deployment commit only). Not patched in the latest version. Suggested Remediation: must match deny/allow patterns against the full tool input (concatenating all candidate fields; or applying unconditionally to all fields, not just the first one. This completes the GHSA-743h fix intent. Reporter: Reporter: zx (GitHub: @manus-use)

Goal Reached Thanks to every supporter — we hit 100%!

ClaudeHookBridge Deny Pattern Bypass via Multi-field Inspection

More from this source