From 4c866eb5e4d1d30c27bed261edce5dc1afbb315b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Mayoral=20Vilches?= Date: Wed, 27 Aug 2025 16:17:47 +0000 Subject: [PATCH] Test and mitigate PoCs 7 to 10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Víctor Mayoral Vilches --- .../tools/reconnaissance/generic_linux_command.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/cai/tools/reconnaissance/generic_linux_command.py b/src/cai/tools/reconnaissance/generic_linux_command.py index 15a6598b..2d47ab8f 100644 --- a/src/cai/tools/reconnaissance/generic_linux_command.py +++ b/src/cai/tools/reconnaissance/generic_linux_command.py @@ -182,6 +182,18 @@ async def generic_linux_command(command: str = "", if re.search(r'cat.*<<.*>.*\.(py|sh|bash|pl|rb|php)', command): if "base64" in command and any(danger in command for danger in ['os.system', 'subprocess', 'exec', 'eval']): return "Error: Blocked attempt to create script with base64 decode and execute pattern via heredoc" + + # CRITICAL MITIGATION: Block creation of scripts containing command substitution in /tmp + # This prevents PoC 10 where external input tricks agent into creating executable with $(env) + if re.search(r'(cat|echo|printf).*>.*/(tmp|var/tmp|dev/shm)/.*\.(sh|bash|py)', command, re.IGNORECASE): + # Check if the content being written contains command substitution + if '$(' in command or '`' in command: + return "Error: Blocked creation of script in temporary directory with command substitution. This is likely a prompt injection attempt." + + # Block heredoc creation of scripts with command substitution in temp directories + if re.search(r'cat.*<<.*EOF.*>.*/(tmp|var/tmp|dev/shm)/', command, re.IGNORECASE): + if '$(' in command or '`' in command: + return "Error: Blocked heredoc creation of script with command substitution in temporary directory." dangerous_patterns = [ r"(?i)rm\s+-rf\s+/", r"(?i):(){ :|:& };:", # Fork bomb