إرسال #857621: nextlevelbuilder GoClaw 3.13.3-beta.3 Authorization Bypass (CWE-285)

# Technical Details
An Authorization Bypass exists in the `detectWrapper` and secure-CLI gate path used by `ExecTool.Execute` in `goclaw/internal/tools/credentialed_exec.go` of GoClaw.

The application fails to recognize PowerShell wrappers such as `pwsh -EncodedCommand` when unwrapping commands for secure-CLI enforcement. Because `pwsh` and `powershell` are omitted from `wrapperBinaries`, a registered high-risk CLI can be hidden inside encoded PowerShell text and bypass the intended grant check.

# Vulnerable Code
File: goclaw/internal/tools/credentialed_exec.go
Method: detectWrapper / collectGateCandidates / ExecTool.Execute
Why: The secure-CLI gate denies only binaries discovered through wrapper unwrapping. PowerShell wrappers are not treated as wrappers, so the protected inner binary never appears in the candidate list and no grant is enforced.

# Reproduction
1. Download `verification_harness.go`, `verification_test.py`, and `control-normal-behavior.py` from the issue-linked gists.
2. Place the files together and, from the repository root, run `python3 llm-enhance/cve-finding/similar/Auth_Bypass/GHSA-3h2q-j2v4-6w5r-powershell-secure-cli-wrapper-exp/verification_test.py`.
3. Observe that a registered secure CLI such as `gh` executes through `pwsh -EncodedCommand` without the intended secure-CLI grant.

# Impact
- Authenticated operator-level callers or agents can execute protected credentialed CLIs without approval.
- This can expose repository administration, cloud, cluster, release, or other privileged automation capabilities behind the wrapped CLI.

• المصدر: ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1215
• المستخدم: Eric-x (UID 94869)
• ارسال: 13/06/2026 05:06 AM (1 شهر منذ)
• الاعتدال: 18/07/2026 09:24 AM (1 month later)
• الحالة: تمت الموافقة
• إدخال VulDB: 380015 [nextlevelbuilder GoClaw حتى 3.13.3-beta.3 credentialed_exec.go ExecTool.Execute تجاوز الصلاحيات]
• النقاط: 20