Unauthenticated RCE in AgenticSeek via Command Injection

AgenticSeek (commit fc242c7) contains a critical unauthenticated remote code execution vulnerability. The application exposes an API endpoint at POST /query which is bound to all network interfaces (0.0.0.0:7777) and configured with wildcard Cross-Origin Resource Sharing (CORS). The vulnerability stems from the application's reliance on the BashInterpreter component, which executes user-supplied queries using subprocess.Popen with shell=True and safety=False. Because the internal command blocklist is incomplete and easily bypassed, a network-adjacent attacker can submit crafted HTTP POST requests to trigger the execution of arbitrary operating system commands on the host. This vulnerability allows for full system compromise without any prior authentication or authorization.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.8, indicating the highest level of severity. Successful exploitation results in unauthenticated, host-level code execution. In environments where AgenticSeek is deployed with network-wide accessibility, any attacker with network adjacency can gain immediate control over the host machine, leading to potential data exfiltration, lateral movement within the network, or the installation of persistent malicious software.

Recommendation

1. Restrict network access to the AgenticSeek API endpoint at port 7777 to trusted management networks only, ensuring it is not reachable from untrusted segments or the public internet.
2. Implement strict authentication middleware for the /query API endpoint to ensure all requests are validated before being processed by the agent.
3. Update the AgenticSeek implementation to utilize subprocess.run with shell=False and pass arguments as a list to prevent shell metacharacter injection.
4. Replace the existing command blocklist with a robust, allowlist-based validation mechanism that strictly defines permissible commands and parameters.
5. Deploy the suggested Sigma rule to monitor for suspicious POST requests targeting the /query endpoint that contain shell metacharacters.