Pentestagent
Monthly
OS command injection via prompt injection in GH05TCREW PentestAgent's LocalRuntime allows a malicious target host to execute arbitrary shell commands on the operator's workstation. When the agent scans an adversary-controlled target, response content such as HTTP bodies, SSH banners, or DNS records flows unfiltered into the LLM's prompt context; a crafted payload steers the LLM into generating reverse-shell or persistence commands that LocalRuntime.execute_command() then runs with full operator-level privileges. A publicly available exploit exists (GitHub issue #91), and the upstream fix (PR #100) remains unmerged at time of analysis.
PentestAgent's MCP HTTP Server (up to commit cf882dabea3ed91cef016cdd115e5426315665a2) bound to all network interfaces (0.0.0.0) by default with zero authentication, allowing any remote attacker to call the `run_task` function in `interface/main.py` and execute arbitrary OS commands on the host running the agent. A public proof-of-concept is available via GitHub issue #90, and the fix (PR #101) adds bearer token auth and changes the default bind address to 127.0.0.1, but the pull request had not yet been merged at time of analysis. The CVSS 4.0 score of 6.9 substantially understates impact given that full unauthenticated OS command execution is achievable.
OS command injection via prompt injection in GH05TCREW PentestAgent's LocalRuntime allows a malicious target host to execute arbitrary shell commands on the operator's workstation. When the agent scans an adversary-controlled target, response content such as HTTP bodies, SSH banners, or DNS records flows unfiltered into the LLM's prompt context; a crafted payload steers the LLM into generating reverse-shell or persistence commands that LocalRuntime.execute_command() then runs with full operator-level privileges. A publicly available exploit exists (GitHub issue #91), and the upstream fix (PR #100) remains unmerged at time of analysis.
PentestAgent's MCP HTTP Server (up to commit cf882dabea3ed91cef016cdd115e5426315665a2) bound to all network interfaces (0.0.0.0) by default with zero authentication, allowing any remote attacker to call the `run_task` function in `interface/main.py` and execute arbitrary OS commands on the host running the agent. A public proof-of-concept is available via GitHub issue #90, and the fix (PR #101) adds bearer token auth and changes the default bind address to 127.0.0.1, but the pull request had not yet been merged at time of analysis. The CVSS 4.0 score of 6.9 substantially understates impact given that full unauthenticated OS command execution is achievable.