AGL App-Framework-Binder Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the AGL app-framework-binder component, specifically in versions through v19.90.0. The issue arises in the supervision Do command, where the on_supervision_call function nullifies request credentials before executing an API call controlled by the attacker. This allows the execution of any registered API with a NULL credential context, potentially bypassing authorization mechanisms and escalating privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation within the AGL app-framework-binder environment.