Skip to content

v6.2.2 — Agent File-Download Hardening

Choose a tag to compare

View all tags
@samugit83 samugit83 released this 25 Jul 08:08
· 940 commits to master since this release
v6.2.2
d96f5a6

RedAmon v6.2.2 — Agent File-Download Hardening

A security patch release. Closes an unauthenticated OS command-injection (RCE) in the agent's GET /files in-chat download endpoint (CWE-78), responsibly disclosed by threatroute66 and tracked as GHSA-vqf8-hfgc-v5cf.

🛡️ Unauthenticated /files command injection closed (Critical, CVSS 9.8)

  • The endpoint interpolated the untrusted path query parameter into a bash -c command run inside kali-sandbox via the kali_shell tool, guarded only by os.path.normpath plus a /tmp/ prefix check that does not strip shell metacharacters. So path=/tmp/x; <cmd> executed arbitrary commands as root inside the sandbox, and the route carried no authentication of its own.
  • The path is now shlex.quoted in both kali_shell sinks so it is always a single literal argument (neutralising ;, |, backtick, $(...), &&, and also repairing legitimate filenames with spaces/parens the unquoted form had broken), and the route now requires require_internal_auth_only. The webapp /api/agent/files proxy forwards the internal key so the now-authenticated endpoint keeps working.
  • On a default docker compose / redamon.sh install the agent is published on 0.0.0.0:8090, so this was remotely reachable. The deploy/single-host hardened posture already keeps the agent REST surface off the public origin (nginx proxies only the four /ws/* paths), so that deployment was not internet-exposed, though the endpoint stayed reachable unauthenticated container-to-container.

✅ Tests

  • 21 unit/regression checks (a shlex.split argument-boundary proof over 11 injection/edge vectors plus real TestClient auth enforcement) and 6 live end-to-end checks against the running agent + kali-sandbox (401 unauthenticated, benign and spaced-filename downloads, and three injection classes proven inert via marker files). Both suites are proven to fail on the pre-fix code.

⬆️ Updating an existing deployment

  • Rebuild both changed images: docker compose build agent webapp && docker compose up -d agent webapp

Full changelog: v6.0.2...v6.2.2

Assets 2
Loading