Summary
OpenHuman can be induced to create persistent shell cron jobs when an attacker sends messages through a configured external channel, without human approval. The jobs run with the privileges of the OpenHuman runtime user, and command validation may allow redirection to a helper executable already present on the host.
OpenHuman can be induced to create persistent shell cron jobs when an attacker sends messages through a configured external channel, without human approval. The jobs run with the privileges of the OpenHuman runtime user, and command validation may allow redirection to a helper executable already present on the host.
Affected context
The issue affects OpenHuman deployments where the agent can receive messages from a configured external channel and use its scheduler to create shell cron jobs. Risk is higher when a suitable helper executable is present on the host and command validation accepts leading environment assignments that can redirect an allowed command. The scheduled jobs run with the privileges of the OpenHuman runtime user.
The issue affects OpenHuman deployments where the agent can receive messages from a configured external channel and use its scheduler to create shell cron jobs. Risk is higher when a suitable helper executable is present on the host and command validation accepts leading environment assignments that can redirect an allowed command. The scheduled jobs run with the privileges of the OpenHuman runtime user.
Exploit preconditions
- Attack surface: A configured external messaging channel connected to the agent
- Required access: Ability to send messages through that channel; direct host access is not described as necessary
- Trigger point: Agent handling of a message that leads it to create a scheduled shell job
- Additional condition: A suitable helper executable must already be available on the host
- Why exploitation is possible: Command validation permits leading environment assignments that can redirect allowed commands, and job creation can occur without human approval
- Attack surface: A configured external messaging channel connected to the agent
- Required access: Ability to send messages through that channel; direct host access is not described as necessary
- Trigger point: Agent handling of a message that leads it to create a scheduled shell job
- Additional condition: A suitable helper executable must already be available on the host
- Why exploitation is possible: Command validation permits leading environment assignments that can redirect allowed commands, and job creation can occur without human approval
Why this happens
The issue combines insufficient command validation with a lack of authorization or approval safeguards for persistent job creation. Allowing leading environment assignments can undermine command restrictions by changing how an allowed command is resolved, corresponding to CWE-78: Improper Neutralization of Special Elements used in an OS Command. Creating cron jobs without an appropriate approval boundary also relates to CWE-285: Improper Authorization.
The issue combines insufficient command validation with a lack of authorization or approval safeguards for persistent job creation. Allowing leading environment assignments can undermine command restrictions by changing how an allowed command is resolved, corresponding to CWE-78: Improper Neutralization of Special Elements used in an OS Command. Creating cron jobs without an appropriate approval boundary also relates to CWE-285: Improper Authorization.
Potential impact
- An attacker may cause persistent command execution under the OpenHuman runtime user's privileges.
- Commands could access or alter data and resources available to that user.
- Persistent jobs could enable continued activity after the initial message interaction.
- A compromised runtime could affect connected systems or services, depending on its access.
- An attacker may cause persistent command execution under the OpenHuman runtime user's privileges.
- Commands could access or alter data and resources available to that user.
- Persistent jobs could enable continued activity after the initial message interaction.
- A compromised runtime could affect connected systems or services, depending on its access.
General mitigation guidance
Defensive approaches generally focus on preventing untrusted messages from directly controlling shell commands or persistent scheduling.
- Prefer fixed, structured operations over constructing shell commands from agent-controlled content.
- Apply strict command allowlists and reject environment assignments or other syntax that can change command resolution.
- Require explicit human authorization before creating persistent jobs or other durable actions.
- Run the agent with least-privilege permissions and limit its access to sensitive data, executables, and host resources.
- Reduce trust in external-channel input and constrain which tools and actions that input can invoke.
- Where feasible, isolate scheduled tasks and restrict the executables and environment they can access.
Defensive approaches generally focus on preventing untrusted messages from directly controlling shell commands or persistent scheduling.
- Prefer fixed, structured operations over constructing shell commands from agent-controlled content.
- Apply strict command allowlists and reject environment assignments or other syntax that can change command resolution.
- Require explicit human authorization before creating persistent jobs or other durable actions.
- Run the agent with least-privilege permissions and limit its access to sensitive data, executables, and host resources.
- Reduce trust in external-channel input and constrain which tools and actions that input can invoke.
- Where feasible, isolate scheduled tasks and restrict the executables and environment they can access.
How teams detect issues like this
- Use static analysis to identify shell command construction, permissive command validators, and paths from external messages to process execution.
- Review agent tool permissions and approval flows for cron or other persistent-job creation.
- Check whether validation accepts environment assignments or permits command resolution to vary at runtime.
- Monitor for unexpected cron job creation and scheduled commands running under the agent's account.
- Enforce policy checks that require human approval for persistent actions and restrict agent access to process-execution capabilities.
- Automated code review tools may help flag risky command-execution and authorization patterns.
- Use static analysis to identify shell command construction, permissive command validators, and paths from external messages to process execution.
- Review agent tool permissions and approval flows for cron or other persistent-job creation.
- Check whether validation accepts environment assignments or permits command resolution to vary at runtime.
- Monitor for unexpected cron job creation and scheduled commands running under the agent's account.
- Enforce policy checks that require human approval for persistent actions and restrict agent access to process-execution capabilities.
- Automated code review tools may help flag risky command-execution and authorization patterns.
