PraisonAI Session Reuse of Tool Approval Bypass

Executive Summary

PraisonAI before version 1.6.78 caches tool approval decisions based only on the tool name, not the arguments. This allows attackers to reuse an initial approval for a benign operation to execute dangerous file write operations with arbitrary parameters in the same session without further review.

Useful 0 Not Useful 0

Executive Summary

PraisonAI before version 1.6.78 caches tool approval decisions based only on the tool name, not the arguments. This allows attackers to reuse an initial approval for a benign operation to execute dangerous file write operations with arbitrary parameters in the same session without further review.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass security controls by first getting approval for a safe action like writing to a non-critical file, then using that cached approval to write to sensitive system files or perform other unauthorized actions without additional checks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating integrity and confidentiality requirements in GDPR and HIPAA. Organizations using PraisonAI may fail compliance audits due to insufficient authorization controls for sensitive operations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect PraisonAI logs for tool approvals that reuse cached decisions without re-evaluating arguments. Check if write_file or similar tools are approved once and then used with different paths in the same session. Look for inconsistencies in approval logs where benign operations are followed by unauthorized file writes.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PraisonAI to version 1.6.78 or later to address the caching flaw. Review and clear any existing approval caches in running sessions. Implement stricter approval checks that include tool arguments in cache keys. Disable inheritance of approval caches in child tasks if possible.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick a user into approving a safe action like writing to a harmless file. The system would then allow the attacker to write to sensitive files or execute malicious operations without additional approvals during the same session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements and HIPAA's safeguards for protected health information. It undermines audit controls and access management.

Useful 0 Not Useful 0