MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym with RTLD_NEXT to resolve glibc's real syscall and bypass the sandbox syscall blacklist. An authenticated workspace member can consequently read or write files, execute processes, or access networks as the sandbox user.
This issue is fixed in version 2.10.6-lts.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/1Panel-dev/MaxKB/commit/d4bd22af8ba14a9dea317f9034332fec4e96…
security-advisories@github.com
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.6-lts
security-advisories@github.com
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-6h35-c779-4v37
security-advisories@github.com