JunoClaw Plugin-Shell Shell-Metacharacter Injection Vulnerability

A shell-metacharacter injection vulnerability has been identified in the JunoClaw AI platform, specifically within the plugin-shell component, in versions prior to v0.x.y-security-1. The issue arises because the run_command function wrapped agent-supplied commands in a shell command execution wrapper, passing the entire argument string to the shell's parser. This allowed shell metacharacters in agent-provided arguments to be interpreted as command syntax, creating a potential for injection attacks.

Impact

Exploitation of this vulnerability allowed for shell metacharacter injection, where metacharacters in agent-supplied arguments were interpreted as command syntax by the shell. This could have been used to manipulate command execution in a harmful way.

Remediation

Users can upgrade to JunoClaw version v0.x.y-security-1 or later to address this vulnerability. Instructions for upgrading are available in the JunoClaw repository's release notes.