PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
# Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands
Summary
PraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a command and args field. The endpoint passes those values into the MCP stdio client, which starts the attacker-selected local process as the PraisonAI UI service user.
The issue is reachable through PraisonAI's hosted UI integration (praisonai ui, praisonai ui agents, praisonai claw, and any app using praisonai.integration.host_app.create_host_app() / build_host_app()). praisonai ui and related Typer UI commands bind to 0.0.0.0 by default.
Affected Versions
Confirmed affected:
praisonai v4.6.48- Commit tested:
d5f1114aaf1a2e9f121a6e66b929149ca2201f1d - Tag tested:
v4.6.48 - Pinned UI dependency:
aiui==0.3.121 from src/praisonai/uv.lock
Likely affected:
- Any PraisonAI release that exposes
aiui / praisonaiui create_app() through the PraisonAI UI host apps without authentication and includes the mcp dependency. I only confirmed the latest release during this audit.
Severity
Reasoning:
AV: the vulnerable endpoint is an HTTP API route.AC: a single POST request is sufficient.PR: default UI host apps do not require credentials unless opt-in auth is configured.UI: no victim interaction is needed after the server is running.S: code executes in the PraisonAI UI server process context.C/I/A: arbitrary local command execution permits secret exfiltration, file tampering, and service disruption.
Root Cause
PraisonAI depends on MCP by default and exposes PraisonAIUI via optional UI extras:
src/praisonai/pyproject.toml:11 includes base dependencies.src/praisonai/pyproject.toml:19 includes mcp>=1.20.0.src/praisonai/pyproject.toml:25 defines the ui extra with aiui>=0.3.121,<0.4.src/praisonai/pyproject.toml:197 defines the claw extra with aiui[all]>=0.3.121,<0.4.
PraisonAI's UI commands bind externally by default and launch aiui run:
src/praisonai/praisonai/cli/commands/ui.py:114 sets host="0.0.0.0" for praisonai ui.src/praisonai/praisonai/cli/commands/ui.py:163 passes that host to aiui run.src/praisonai/praisonai/cli/commands/ui.py:186, :204, and :222 also default subcommands to 0.0.0.0.src/praisonai/praisonai/cli/commands/claw.py:41 defines the full dashboard command.src/praisonai/praisonai/cli/commands/claw.py:93 launches aiui run with the selected host.
PraisonAI's default apps create the PraisonAIUI Starlette app without forcing authentication:
src/praisonai/praisonai/ui_chat/default_app.py:18 calls configure_host(...).src/praisonai/praisonai/ui_chat/default_app.py:142 exports app = create_host_app().src/praisonai/praisonai/claw/default_app.py:63 calls configure_host(...).src/praisonai/praisonai/claw/default_app.py:128 exports app = create_host_app().src/praisonai/praisonai/integration/host_app.py:174 imports praisonaiui.server.create_app.src/praisonai/praisonai/integration/host_app.py:180 returns create_app().
In aiui==0.3.121, the exposed server registers the MCP routes and auth is opt-in:
praisonaiui/server.py:1483 defines api_mcp_connect.praisonaiui/server.py:1488 reads attacker-controlled JSON.praisonaiui/server.py:1491 accepts either command or url.praisonaiui/server.py:1496 calls connect_mcp_server(body).praisonaiui/server.py:2516 defines create_app(..., require_auth=False, ...).praisonaiui/server.py:2550 adds AuthEnforcementMiddleware, but it only enforces auth when AUTH_ENFORCE=true.praisonaiui/server.py:2769 registers /api/mcp/servers.praisonaiui/server.py:2770 registers /api/mcp/connect.
The MCP feature converts the request body into a local process launch:
praisonaiui/features/mcp.py:325 defines connect_server(self, server_config).praisonaiui/features/mcp.py:330 chooses stdio transport when command is present.praisonaiui/features/mcp.py:332 constructs StdioMCPClient(command=server_config["command"], args=server_config.get("args", [])).praisonaiui/features/mcp.py:360 calls client.connect(), which invokes the MCP stdio transport and starts the process.
Minimal PoC
PoC file: poc/praisonai-aiui-mcp-connect-rce.py
The PoC runs the PraisonAI host app in-process, sends the unauthenticated HTTP request, and asks the server to execute /usr/bin/touch /tmp/praisonai_host_app_mcp_touch_marker.txt. It does not contact an LLM provider and uses no credentials.
Observed output from the tested checkout with aiui==0.3.121 and mcp==1.25.0 available:
```text
[19:19:55
