zhayujie CowAgent Missing Authorization Vulnerability in Message Endpoint Remote Code Execution

A remote code execution vulnerability has been identified in zhayujie CowAgent versions through 2.1.0. The issue arises from a missing authorization in the Message Endpoint component, specifically within an unknown function in the file channel/channel.py. This flaw allows remote or authenticated users to execute arbitrary shell commands via the application's web chat interface, using the same privileges as the CowAgent process user.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server, with potential filesystem modifications depending on the executed commands. In practice, this could lead to unauthorized changes in automation artifacts, scripts, or knowledge files, as well as reading or exfiltrating local data accessible to the process. Such actions could facilitate further host or network pivoting, depending on the deployment's permission settings.

Reproduction

The vulnerability can be reproduced by sending a message through the web channel's 'POST /message' interface while agent mode is enabled. This message can be crafted to include a command that the 'bash' tool will execute. After the message is processed, the command's effects can be observed in the filesystem, such as the creation of a file containing a specific canary value. In contrast, replacing the command with a benign 'ls' operation demonstrates the absence of similar effects, confirming the exploitation.