إرسال #862539: nextlevelbuilder GoClaw 3.13.2 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

# Technical Details
An Environment Secret Disclosure via `env_dump` Policy Bypass exists in the `shell_deny_groups.go` deny rules and the `executeOnHost()` method in `internal/tools/shell.go` of GoClaw.

The application fails to block `jq` `$ENV` access to GoClaw secrets despite having `env_dump` deny rules. The `env_dump` deny group in `internal/tools/shell_deny_groups.go` blocks common environment disclosure patterns (`env`, `printenv`, `echo $GOCLAW_*`, `printf $GOCLAW_*`, `python os.environ`, `node process.env`) but has no pattern covering `jq -nr '$ENV.GOCLAW_*'`. Additionally, the static credential environment scrub list in `internal/tools/env_scrub.go` omits `GOCLAW_GATEWAY_TOKEN`, `GOCLAW_ENCRYPTION_KEY`, and `GOCLAW_POSTGRES_DSN`. When a command passes through the deny rules, `executeOnHost()` spawns the child process with these secrets still inherited, allowing `jq` to read them.

# Vulnerable Code
File: internal/tools/shell_deny_groups.go
Method: env_dump deny rules — covers echo, printf, python os.environ, node process.env patterns but has no pattern for jq $ENV access
File: internal/tools/env_scrub.go
Method: scrubCredentialEnv() — static scrub list excludes GOCLAW_GATEWAY_TOKEN, GOCLAW_ENCRYPTION_KEY, GOCLAW_POSTGRES_DSN
Why: The deny list is pattern-based and does not anticipate jq's $ENV primitive as an environment disclosure vector. Combined with the incomplete env scrub, this creates a gap where jq can read GoClaw secrets without triggering any deny rule.

# Reproduction
1. Deploy GoClaw with the built-in exec tool enabled and `GOCLAW_GATEWAY_TOKEN` in the process environment.
2. Authenticate as an operator and send `{"tool":"exec","args":{"command":"jq -nr '$ENV.GOCLAW_GATEWAY_TOKEN'"}}` to `POST /v1/tools/invoke`.
3. Observe HTTP 200 response with the canary gateway token in `result.output`.
4. Confirm a control request using `echo $GOCLAW_GATEWAY_TOKEN` is rejected with HTTP 400 `command denied by safety policy`.

# Impact
- Sensitive information disclosure defeating the product's own environment secret protection model.
- An operator-level principal can recover the gateway bearer token and pivot into broader API access.
- The bypass is not limited to `GOCLAW_GATEWAY_TOKEN`; any `GOCLAW_*` secret in the process environment is readable through this path.

• المصدر: ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1227
• المستخدم: Erichen-apple (UID 99087)
• ارسال: 18/06/2026 08:32 AM (2 أشهر منذ)
• الاعتدال: 05/08/2026 06:14 PM (2 months later)
• الحالة: مكرر
• إدخال VulDB: 383813 [nextlevelbuilder GoClaw حتى 3.13.2 jq Handler tools_invoke.go ExecTool.Execute الكشف عن المعلومات]
• النقاط: 0