An Evening with Claude (Code) sed-Based Command Safety Bypas...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/
• Blog Title: An Evening with Claude (Code): sed-Based Command Safety Bypass in Claude Code (CVE-2025-64755)
• Suggested Section: AI -> AI Security -> AI MCP Security (add a subsection on "LLM Agent Command Validation Bypass (Node CLI, regex allowlists, sed-based file write/RCE)")

🎯 Content Summary

This post details a command-execution protection bypass in Anthropic’s Claude Code CLI that leads to remote code execution (RCE) by abusing incomplete sed expression validation inside the BashCommand tool. The issue is tracked as CVE-2025-64755 and was fixed in Claude Code v2.0.31; version 2.0.25 was confirmed vulnerable.

The author’s assessment goal was to show the risks ...

🔧 Technical Details

Bypassing anti-debugging in obfuscated Node.js CLIs
When reversing an obfuscated Node.js CLI like Claude Code’s cli.js, start it with an initial breakpoint via node --inspect-brk cli.js and attach DevTools. Look for logic that reads process.execArgv or similar to detect debugging flags and abort. Patch those values at runtime in the DevTools console (e.g., process.execArgs = []) before resuming execution. This lets you step through normally hidden security logic, without modifying the on-disk file.

Converting an LLM-driven shell validator into a local fuzzing harness
For LLM shells that internally validate commands, use breakpoints to identify the function where the complete shell command string hits the security checks (e.g., BashCommand’s checkPermissions pipeline). Once found, rename it for clarity and invoke it directly in the debugger console with arbitrary strings. This bypasses...

🤖 Agent Actions

Summary:

• Extended AI-MCP-Servers.md with a dedicated section on Claude Code’s sed-based command validation bypass (CVE-2025-64755), covering anti-debug evasion, validator fuzzing, the multi-stage allow/deny pipeline, bypass payloads, and persistence/secret-theft impact via MCP or prompt-injection delivery channels.
• Added defensive guidance (patching to v2.0.31, restricting BashCommand/sed, monitoring Anthropic telemetry endpoints) and updated the references list with the SpecterOps research source.

Tests: Not run (documentation-only changes).

Files Modified:

• src/AI/AI-MCP-Servers.md

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/

Content Categories: Based on the analysis, this content was categorized under "AI -> AI Security -> AI MCP Security (add a subsection on "LLM Agent Command Validation Bypass (Node CLI, regex allowlists, sed-based file write/RCE)")".

Repository Maintenance:

• MD Files Formatting: 913 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0