| Título | mf-yang openclaw-cn 0.2.1 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| Descripción | # Technical Details
An authenticated local file disclosure vulnerability exists in the browser control HTTP API of `openclaw-cn`. The `POST /tabs/open` endpoint accepts a caller-controlled `url` field and forwards it through `openTab()` → `assertBrowserNavigationAllowed()` → `createTargetViaCdp()`. The navigation guard in `src/browser/navigation-guard.ts` only validates `http:` and `https:` schemes and returns early for every other protocol, allowing `file://` URLs to bypass rejection entirely and reach the CDP `Target.createTarget` sink.
# Vulnerable Code
File: src/browser/navigation-guard.ts (Lines 3-27)
Method: `assertBrowserNavigationAllowed()`
Why: The guard checks `if (!NETWORK_NAVIGATION_PROTOCOLS.has(parsed.protocol)) { return; }` — only `http:` and `https:` are in the set, so `file:` (and any other unsupported scheme) returns early without blocking.
File: src/browser/routes/tabs.ts (Lines 30-40)
Method: `POST /tabs/open` route handler
Why: Accepts the attacker-controlled `url` from the request body and forwards it directly to `profileCtx.openTab(url)`.
File: src/browser/server-context.ts (Lines 151-181)
Method: `openTab()`
Why: Retrieves the caller-controlled URL, invokes the incomplete guard, then forwards the same URL into the CDP tab-creation path.
File: src/browser/cdp.ts (Lines 81-105)
Method: `createTargetViaCdp()`
Why: Issues CDP `Target.createTarget` with the original attacker-controlled URL, reaching the real browser sink.
# Reproduction
1. Set up `openclaw-cn` version <= 0.2.1 with the browser control HTTP API enabled and token authentication.
2. Create a canary file at a known path readable by the OpenClaw process (e.g., `/tmp/canary.html`).
3. Send `POST /tabs/open` with `{"url": "file:///tmp/canary.html"}` — observe HTTP 200 with a valid `targetId`.
4. Call `GET /snapshot?targetId=<targetId>` — observe the snapshot JSON contains the canary text from the local file.
5. Run the control case with `{"url": "about:blank"}` — confirm the snapshot does not contain the canary, proving the leak depends on the unsupported `file:` scheme bypass.
# Impact
- Any authenticated browser-control caller can cause the managed Chrome instance to render local files readable by the OpenClaw process user.
- Enables recovery of rendered text from local HTML reports, temporary files, exported debugging artifacts, or other browser-readable local content.
- Breaks the intended navigation safety boundary and exposes host-local data through a documented HTTP API.
- Impact bounded by the product's trusted-operator model but still breaks navigation isolation guarantees. |
|---|
| Fuente | ⚠️ https://github.com/mf-yang/openclaw-cn/issues/561 |
|---|
| Usuario | Erichen-x (UID 99082) |
|---|
| Sumisión | 2026-06-18 04:40 (hace 1 mes) |
|---|
| Moderación | 2026-07-25 20:54 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 383319 [mf-yang openclaw-cn hasta 0.2.1 Scheme navigation-guard.ts assertBrowserNavigationAllowed url divulgación de información] |
|---|
| Puntos | 20 |
|---|