| Titel | nextlevelbuilder GoClaw 3.13.3-beta.3 Server-Side Request Forgery (CWE-918) |
|---|
| Beschreibung | # Technical Details
A Server-Side Request Forgery exists in the `bytePlusDownloadVideo` method in `internal/tools/create_video_byteplus.go` of GoClaw.
The application fails to apply the product's SSRF protections to provider-returned media URLs. An authenticated operator can invoke `POST /v1/tools/invoke` and trigger the `create_video` workflow. If the upstream provider returns a malicious `output.video_url`, GoClaw fetches that URL with a plain `http.Client` from the gateway host itself. The issue also affects the same provider-returned download pattern in `internal/tools/create_video_gemini.go` and `internal/tools/create_video_minimax.go`.
# Vulnerable Code
File: internal/tools/create_video_byteplus.go
Method: bytePlusDownloadVideo
Why: After task success, the code reads `taskResp.Output.VideoURL` and downloads it with `http.NewRequestWithContext(..., videoURL, nil)` and `client.Do(req)` instead of using SSRF validation like `CheckSSRF(...)` and pinned-IP dialing used elsewhere such as `internal/tools/web_fetch.go`.
# Reproduction
1. Configure a vulnerable GoClaw instance on version `3.13.3-beta.3` with the `create_video` tool enabled and point it at a controlled or malicious video provider.
2. Invoke `POST /v1/tools/invoke` for `create_video` so the provider returns a crafted `video_url` such as a loopback or internal-network endpoint.
3. Observe that the GoClaw server fetches the attacker-chosen internal URL from the gateway host during media download.
# Impact
- Authenticated operators can coerce the gateway into fetching loopback, private-network, or metadata URLs.
- Internal HTTP responses, admin panels, and other non-public network resources may become reachable from the server's network position. |
|---|
| Quelle | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1199 |
|---|
| Benutzer | Eric-b (UID 96354) |
|---|
| Einreichung | 11.06.2026 09:10 (vor 1 Monat) |
|---|
| Moderieren | 13.07.2026 19:23 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 378126 [nextlevelbuilder GoClaw 3.13.3-beta.3 invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo output.video_url erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|