Description

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credential_process, then select that profile during a later model-validation request so botocore executes an attacker-controlled command as root. This vulnerability is fixed in 2.10.5-lts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-21T21:17:12.450Z",
  "pubdate": "2026-09-21T21:17:12.450Z",
  "executiveSummary": "MaxKB versions prior to 2.10.5-lts contain a critical command injection vulnerability stemming from improper input validation in AWS configuration management.\nThe vulnerability allows an authenticated workspace member to perform unauthorized command execution with root privileges on the underlying host.\nBy injecting malicious control characters into the 'access_key_id' or 'secret_access_key' fields via the '_update_aws_credentials' function, an attacker can manipulate the '/root/.aws/credentials' file structure.\nThis manipulation enables the injection of a malicious AWS profile containing the 'credential_process' directive, which is subsequently executed by the botocore library when the application performs model validation.\nThe impact is severe, resulting in full remote code execution (RCE) as the root user. The risk is heightened by the ability to escalate privileges from a standard authenticated workspace member to root level on the host system. Deployment of MaxKB version 2.10.5-lts or later is required to address this security flaw.",
  "technicalDetails": "The vulnerability resides in the application's credential management logic, specifically within the '_update_aws_credentials' function. The root cause is the lack of sanitization or strict parsing when handling AWS credentials provided by users through the application interface.\nThe '/root/.aws/credentials' file is a standard configuration file utilized by the AWS SDK for Python (boto3/botocore). When the application writes user-supplied input directly to this file without escaping newline characters or other control sequences, an attacker can manipulate the structure of the configuration file. By inserting carriage returns and newlines, the attacker can break out of the intended 'default' profile and define a new, arbitrary AWS profile.\nThe exploitation flow proceeds as follows: First, the attacker provides a crafted payload into the 'access_key_id' or 'secret_access_key' input fields. This payload includes control characters followed by a new configuration entry: '[malicious_profile]\\ncredential_process = /path/to/attacker/command'. When '_update_aws_credentials' writes this to disk, the file effectively contains an executable directive that the AWS SDK interprets as a legitimate method for retrieving credentials.\nSecond, the attacker triggers an action within MaxKB that performs a model-validation request. During this request, the application is instructed—or configured—to utilize the newly created 'malicious_profile'.\nThird, the botocore library, upon attempting to refresh or fetch credentials for the specified profile, executes the command defined in 'credential_process'. Because the application process often runs with elevated permissions, the injected command is executed as the root user.\nThis vulnerability requires the attacker to be an authenticated workspace member, meaning it is not accessible to unauthenticated remote attackers. However, the elevation of privilege from an authenticated user to system-level root access makes this a critical security concern. Post-exploitation, an attacker gains complete control over the container or host instance, allowing for data exfiltration, lateral movement within the infrastructure, and further persistence."
}