[BUG] /tools/call 接口未鉴权导致越权及任意系统命令执行 (RCE)

[QiuYucheng2003]

问题描述 / Problem Description
项目中的工具调用 API 路由存在未授权访问漏洞。tool_routes.py 中的 /tools/call POST 接口缺乏身份验证机制，允许任意外部请求访问。同时，shell.py 中注册的 shell 工具直接封装了 ShellTool，未对外部输入进行安全过滤。攻击者可以通过未鉴权的 API 越权调用 shell 工具，传入恶意载荷，从而在服务器宿主机上执行任意系统命令，获取服务器控制权。

复现问题的步骤 / Steps to Reproduce

1. 部署并启动 Langchain-Chatchat 服务（需包含系统命令工具配置）。

2. 在未经任何身份认证的情况下，向服务器发送如下构造的恶意 POST 请求：
   POST /tools/call HTTP/1.1
   Content-Type: application/json

{
"name": "shell",
"tool_input": {
"query": "whoami && id"
}
}

3. 检查服务器端状态以及接口返回的响应数据。

4. 问题出现：由于缺乏鉴权，API 成功接纳请求，并将 query 参数传递给 ShellTool 执行。

预期的结果 / Expected Result
敏感的 API 接口（特别是涉及工具调用的 /tools/call）应当受到严格的身份鉴权保护（如 Token 校验）。未经授权的访问应当被拒绝（返回 HTTP 401/403 状态码）。此外，高危工具（如系统命令执行）不应直接暴露，或应对输入参数进行严格的沙箱隔离和过滤。

实际结果 / Actual Result
接口无需任何凭证即可调用。通过 tool_input 传入的系统命令被宿主机直接执行，且执行结果会明文返回在响应包的 data 字段中，造成严重的安全风险（RCE）。

[dosubot]

This is a confirmed and previously reported vulnerability. Two earlier issues reported the same Pre-Auth RCE:

• #5456 - Security: Unauthenticated RCE via /tools/call shell endpoint (CVSS 10.0) [1]
• #5460 - Pre-Auth RCE via Unauthenticated Shell Tool Invocation [2]

Both were closed by the stale bot without a fix being merged.

From reviewing the code, the root causes are confirmed:

1. No authentication on /tools/call — The endpoint in tool_routes.py accepts name and tool_input with no auth checks, decorators, or middleware [3].
2. Shell tool has zero input sanitization — It directly wraps ShellTool.run() with no filtering or command allowlisting [4].
3. No application-level auth exists — The entire FastAPI app has no authentication middleware; the only security-related config is an optional permissive CORS policy [5].

These issues remain unresolved in the current codebase. As noted in the prior reports, the recommended remediations are:

• Add authentication middleware (e.g., API key / Bearer token) to the FastAPI app
• Remove or disable the shell tool from default registration, or gate it behind an explicit opt-in config
• Add a tool invocation allowlist to /tools/call
• If shell access is retained, enforce command allowlisting and sandboxing

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.