| Título | mf-yang openclaw-cn 0.2.1 Server-Side Request Forgery (CWE-918) |
|---|
| Descripción | # Technical Details
A Browser Interaction-Driven SSRF Policy Bypass exists in the `/act` click route in `src/browser/routes/agent.act.ts` of openclaw-cn.
The application fails to re-validate the final URL after a navigation-capable click action. Direct navigation via `POST /navigate` is protected by `assertBrowserNavigationAllowed()` with SSRF policy enforcement. However, the `/act` click route forwards click requests to `clickViaPlaywright()` without any `ssrfPolicy` plumbing or post-click destination validation. An attacker can load attacker-controlled HTML via a benign `data:` URL, obtain a clickable link ref via `/snapshot`, and click it via `/act` to navigate the browser to a loopback/private target. The content can then be read back via `/snapshot`.
# Vulnerable Code
File: src/browser/routes/agent.act.ts (lines ~64-80)
Method: /act click handler — builds click request and forwards to clickViaPlaywright() without SSRF policy or post-click destination validation
File: src/browser/pw-tools-core.interactions.ts (lines ~26-55)
Method: clickViaPlaywright() — resolves attacker-controlled ref and calls locator.click() directly with no navigation revalidation
Why: Security boundary is inconsistent between explicit navigation (protected by assertBrowserNavigationAllowed) and interaction-driven navigation (no SSRF revalidation after click).
# Reproduction
1. Start browser-control server with `browser.ssrfPolicy.allowPrivateNetwork=false`.
2. Start a loopback canary HTTP server.
3. Verify direct `POST /navigate` to the canary URL returns 400 "Blocked: private/internal IP address".
4. Navigate to a `data:` page containing a link to the loopback canary URL.
5. `GET /snapshot` to obtain the clickable ref, then `POST /act` to click it.
6. Confirm the browser lands on the blocked loopback target and `GET /snapshot` exposes the canary content.
# Impact
- SSRF-style private-network access control bypass in the browser-control subsystem.
- Authenticated caller can use the controlled browser as a read-capable pivot into loopback or private HTTP resources.
- Exposes localhost-only admin/debug endpoints, private-network dashboards, and metadata services that the SSRF policy was supposed to block. |
|---|
| Fuente | ⚠️ https://github.com/mf-yang/openclaw-cn/issues/562 |
|---|
| Usuario | JohnChen (UID 99088) |
|---|
| Sumisión | 2026-06-18 08:56 (hace 2 meses) |
|---|
| Moderación | 2026-08-05 20:52 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 383320 [mf-yang openclaw-cn hasta 0.2.1 Browser Control HTTP API agent.act.ts clickViaPlaywright escalada de privilegios] |
|---|
| Puntos | 0 |
|---|