Shell Command Denylist Bypass in significant-gravitas/autogpt

A security vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings [1][2]. The issue occurs when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist [2].

To exploit this vulnerability, an attacker only needs to craft shell commands using benign path variations like inserting './' into the command path. No special privileges beyond the ability to issue shell commands to the agent are required. The attacker can achieve execution of arbitrary blocked commands through this path manipulation technique [2].

The impact is that an attacker can execute arbitrary shell commands that were intended to be blocked by the denylist. This can lead to unauthorized actions on the host system depending on the permissions the agent runs with [2]. The AutoGPT project documentation now explicitly states that the shell configuration components are not intended for security and recommends using more appropriate sandboxing in production environments [3].

Mitigation for users who need stronger isolation is to avoid relying on the denylist for security. The project has added documentation clarifying that the shell command features are "for convenience only" and not secure. Users are advised to implement proper sandboxing, such as using Docker containers with restricted permissions, to securely constrain agent shell execution [3].