Plateforme
python
Composant
astrbot
Corrigé dans
4.22.1
4.22.2
Une vulnérabilité a été identifiée dans AstrBot, affectant les versions 4.22.0 et 4.22.1. Cette vulnérabilité se manifeste dans la fonction 'installpluginupload' du fichier 'astrbot/dashboard/routes/plugin.py'. La manipulation de l'argument 'File' peut entraîner un problème de sandbox, permettant potentiellement l'exécution de code non autorisé.
The core of this vulnerability lies in the mishandling of file uploads within AstrBot's plugin installation process. An attacker can exploit this by crafting malicious plugin files designed to bypass the intended sandbox restrictions. Successful exploitation could lead to arbitrary code execution on the server hosting AstrBot, granting the attacker complete control over the system. This could involve data theft, modification of system configurations, or even the deployment of further malicious payloads. The public availability of an exploit significantly increases the likelihood of widespread exploitation.
This vulnerability has been publicly disclosed and a proof-of-concept exploit is available, indicating a higher probability of exploitation. The vulnerability has been added to the CISA KEV catalog, further emphasizing its significance. The lack of a response from the project developers raises concerns about the timeliness of a patch and the potential for continued exploitation.
Organizations and individuals utilizing AstrBot for automation and chatbot development are at risk. Specifically, those running versions 4.22.0 through 4.22.1 are particularly vulnerable. Shared hosting environments where AstrBot is deployed alongside other applications are also at increased risk, as a successful exploit could potentially compromise the entire hosting infrastructure.
• python / server:
ps aux | grep astrbot• python / server:
journalctl -u astrbot -f | grep "install_plugin_upload"• generic web:
curl -I http://your-astbot-server/dashboard/routes/plugin.pydisclosure
Statut de l'Exploit
EPSS
0.04% (percentile 13%)
CISA SSVC
The primary mitigation for CVE-2026-6117 is to upgrade AstrBot to a version that addresses this vulnerability. As of the current information, no patched version has been released. Until a patch is available, consider implementing temporary workarounds. These might include restricting file upload sizes, implementing stricter file type validation on the server-side, and employing a Web Application Firewall (WAF) to filter out potentially malicious requests. Monitor AstrBot's logs for any suspicious file upload activity. After a patch is released, upgrade AstrBot and confirm the fix by attempting a plugin upload with a known malicious payload (in a controlled environment) to ensure the sandbox restrictions are properly enforced.
Actualice AstrBot a una versión corregida. El proveedor no ha respondido a los informes de vulnerabilidad, por lo que se recomienda monitorear las actualizaciones oficiales del proyecto para obtener una solución.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
C'est un problème de sandbox affectant AstrBot, qui pourrait permettre l'exécution de code non autorisé.
Si vous utilisez AstrBot versions 4.22.0 ou 4.22.1, vous êtes potentiellement affecté.
Aucun correctif officiel n'est disponible pour le moment. Il est recommandé de mettre à jour vers une version ultérieure si disponible.
Vecteur CVSS
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Téléverse ton fichier requirements.txt et nous te dirons instantanément si tu es affecté.