🧪 PoC 复现

从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。

📋 代码元数据语言md来源Hunt-Benito/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明

# CVE-2026-73678 — Unauthenticated RCE in MindsDB Minds Platform / MindsHub Cowork

PoC for **CVE-2026-73678** (CVSS 3.1 **10.0 Critical**,
`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`).
Full write-up: **www.hunt-benito.com/blog/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork/**

The Cowork `cowork-server` FastAPI sidecar exposes `/api/v1/` with **no authentication**
(CWE-306),CORS `allow_origins=["*"]` (CWE-942),
and the Anton agent's `scratchpad`
tool executes LLM-generated Python via a raw `exec()` with no sandbox (CWE-94).

Chain: plant the **attacker's own** LLM key via `PUT /api/v1/settings/*` → `POST /api/v1/responses/`
with a prompt that makes the agent run attacker code on the scratchpad → arbitrary OS
command execution as the user running the app.

Adapted from the PoC in MindsDB's advisory GHSA-jcxw-h8ph-pxpv (credit: Ho Viet Khanh / HK4zCzi).

## Requirements

- Python 3.9+ (standard library only — no pip installs)
- A running Minds Platform / MindsHub Cowork instance (default `127.0.0.1:26866`)
- Any OpenAI- or Gemini-compatible API key **belonging to the attacker** — nothing
  from the victim is needed

## Usage

```bash
# against a local dev instance (make dev-web)
python3 shell.py AIzaSy... gemini

# explicit target + model
API=http://127.0.0.1:26866/api/v1 python3 shell.py sk-... openai gpt-4o-mini
```

```
[*] Setting provider=gemini model=gemini-2.5-flash
[*] validate: {"status": "ok",
"configReady": true,...}=======================================================
  RCE SHELL  (type shell commands,
'exit' to quit)
=======================================================
$ id
uid=1000(victim) gid=1000(victim) groups=1000(victim),27(sudo)
```

## Why the nonce proves execution

The generated snippet computes `os.urandom(4).hex()` **inside the victim process**
and writes it to `/tmp/RCE_PROOF.txt`. The prompt tells the model it cannot know the
nonce without executing. If the returned text contains a nonce matching the file on
disk,
the code demonstrably ran — a hallucinating model cannot produce it.

## Mitigations (if you run the app)

```bash
export COWORK_REQUIRE_AUTH=true          # auth exists but defaults OFF
export COWORK_AUTH_TOKEN="<long-random>" # or let it auto-generate
export COWORK_ALLOWED_ORIGINS='["http://localhost:26866"]'
# never set COWORK_SERVER_HOST beyond 127.0.0.1;
rotate all secrets reachable
# by the account that ran the app
```

No patched release tag exists;
fixes live only on the `cowork-server`/`anton`
`main` branches.

## Legal

For authorized security testing and research only. Do not run against systems
you do not own or have explicit permission to test.

## References

- GHSA-jcxw-h8ph-pxpv: https://github.com/mindsdb/mindshub/security/advisories/GHSA-jcxw-h8ph-pxpv
- NVD CVE-2026-73678: https://nvd.nist.gov/vuln/detail/CVE-2026-73678
- VulnCheck advisory: https://www.vulncheck.com/advisories/mindsdb-minds-platform-unauthenticated-rce-via-scratchpad-exec

⚔️ EXP 利用代码

截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。

🕵️ 检测指纹

当前规则库未收录针对该 CVE 的专用检测规则。建议：

• 根据漏洞根因编写 Nuclei 检测模板
• 在 WAF/IDS 中配置针对漏洞特征的规则
• 关注漏洞指纹库更新

🤖 高危漏洞深度独立研究引擎生成 · 2026-08-17 03:01