| عنوان | nextlevelbuilder GoClaw 3.13.2 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| الوصف | # Technical Details
A Sensitive Credential Exposure via Auto-Approved Safe Binary exists in the `ExecApprovalManager.CheckCommand()` method in `internal/tools/exec_approval.go` and the `executeOnHost()` method in `internal/tools/shell.go` of GoClaw.
The application fails to prevent environment secret disclosure through auto-approved safe binaries. When `tools.execApproval.security=full` and `tools.execApproval.ask=on-miss`, `jq` is hardcoded as a safe binary and auto-approved. The static credential environment scrub list in `internal/tools/env_scrub.go` omits `GOCLAW_GATEWAY_TOKEN` and `GOCLAW_ENCRYPTION_KEY`, so these secrets remain in the child process environment when `executeOnHost()` spawns `/bin/sh -c <command>`. An authenticated operator can invoke `jq -nr '$ENV.GOCLAW_GATEWAY_TOKEN'` via `POST /v1/tools/invoke` to read the gateway bearer token.
# Vulnerable Code
File: internal/tools/exec_approval.go
Method: CheckCommand() — `jq` classified as safe binary and auto-approved in ExecSecurityFull + ExecAskOnMiss mode without semantic validation
File: internal/tools/env_scrub.go
Method: scrubCredentialEnv() — static credential scrub list omits GOCLAW_GATEWAY_TOKEN and GOCLAW_ENCRYPTION_KEY
Why: Safe binary classification trusts `jq` unconditionally, and the env scrub list does not include GoClaw's own process secrets. Together, these allow `jq $ENV` to read unprotected gateway tokens through the normal tool execution path.
# Reproduction
1. Deploy GoClaw with `tools.execApproval.security=full` and `tools.execApproval.ask=on-miss`.
2. Ensure `GOCLAW_GATEWAY_TOKEN` is set in the gateway process environment and `jq` is available on the host.
3. Authenticate as an operator and send `{"tool":"exec","args":{"command":"jq -nr '$ENV.GOCLAW_GATEWAY_TOKEN'"}}` to `POST /v1/tools/invoke`.
4. Observe HTTP 200 response with the live gateway token in `result.output`.
5. Confirm a control request using `echo $GOCLAW_GATEWAY_TOKEN` is rejected with HTTP 400, proving this is a policy bypass specific to the auto-approved `jq` path.
# Impact
- Sensitive credential exposure: an authenticated operator can steal the gateway bearer token and escalate to broader HTTP/WebSocket gateway control.
- The same path can expose `GOCLAW_ENCRYPTION_KEY` and other GoClaw runtime secrets preserved in the host process environment.
- This defeats the exec approval security model by exploiting the safe binary trust boundary. |
|---|
| المصدر | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1226 |
|---|
| المستخدم | Erichen-apple (UID 99087) |
|---|
| ارسال | 18/06/2026 08:32 AM (1 شهر منذ) |
|---|
| الاعتدال | 28/07/2026 10:32 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 383813 [nextlevelbuilder GoClaw حتى 3.13.2 jq Handler tools_invoke.go ExecTool.Execute الكشف عن المعلومات] |
|---|
| النقاط | 20 |
|---|