Langroid Direct Tool Invocation Vulnerability in Chat Interface

A vulnerability in Langroid applications prior to version 0.65.7 allows untrusted users to invoke tools directly by sending raw JSON payloads through the chat interface. This issue arises because the tool invocation process does not verify the message source, enabling users to execute handlers for tools registered as 'handle-only' and not meant for direct use.

Impact

Exploitation of this vulnerability allows users to invoke tools that could read or write files, execute database queries, or access internal orchestration tools, depending on the enabled handlers.

Reproduction

To reproduce this vulnerability, create a Langroid chat agent and register a tool with 'use=False' and 'handle=True'. Then, send a message containing raw JSON that invokes the tool. The agent will execute the tool's handler, demonstrating the unauthorized invocation.

Remediation

Users can update to Langroid version 0.65.7, which addresses this vulnerability by implementing a trust filter that blocks handle-only tools from being invoked through tainted messages.