Arbitrary File Write and Command Execution in PraisonAI AICoder

Executive Summary

This vulnerability exists in the AICoder component of PraisonAI versions 4.6.77 and below. It allows attackers to perform arbitrary file writes and execute arbitrary shell commands due to missing path validation and command sanitization in LLM tool calls.

Attackers can inject malicious prompts through the chat interface, which then exploit the `write_to_file` function to write files to any location on the filesystem, such as system-critical files like `/etc/cron.d/backdoor` or `/root/.ssh/authorized_keys`.

Additionally, the `execute_command` function runs unsanitized shell commands from LLM responses, enabling full command injection, for example, downloading and executing malicious scripts.

Because the software often runs inside Docker containers with root privileges, successful exploitation can lead to complete system compromise.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including complete system compromise.

• Attackers can write arbitrary files anywhere on the filesystem, potentially creating backdoors or modifying critical system files.
• Attackers can execute arbitrary shell commands with root privileges, allowing them to take full control of the affected system.
• The vulnerability has a critical CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for suspicious files written to critical system locations such as /etc/cron.d/ or /root/.ssh/authorized_keys, which may indicate arbitrary file writes.

Additionally, monitoring for unusual shell commands executed by the AICoder component or unexpected network activity such as downloads and executions of scripts (e.g., via curl commands) can help detect exploitation attempts.

• Check for unexpected files in sensitive directories: ls -l /etc/cron.d/ /root/.ssh/authorized_keys
• Search system logs for suspicious command executions or LLM tool calls.
• Use process monitoring tools (e.g., ps, top) to identify unusual processes spawned by PraisonAI.
• Monitor network traffic for suspicious outbound connections, such as curl commands fetching scripts from attacker-controlled domains.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade PraisonAI to version 4.6.78 or later, where the vulnerability has been patched.

Until the upgrade can be applied, restrict access to the AICoder component and the chat interface to trusted users only to reduce the risk of exploitation.

Additionally, monitor and audit file writes and command executions originating from PraisonAI to detect and respond to any suspicious activity promptly.

Useful 0 Not Useful 0