| Título | OpenClaw openclaw <= 2026.3.14 Path Traversal / Sandbox Escape (CWE-22) |
|---|
| Descripción | # Technical Details
A sandbox media root bypass exists in `normalizeSandboxMediaParams` in `src/infra/outbound/message-action-params.ts` and in `handlePluginAction` in `src/infra/outbound/message-action-runner.ts` of OpenClaw.
The application validates only selected media parameter keys such as `media`, `path`, and `filePath`. Keys used by channel plugins, including `mediaUrl` and `fileUrl`, are not normalized against the sandbox root. The dispatch path also omits `mediaLocalRoots`, causing plugins to fall back to broader default media roots and allowing files from other agent workspaces to be read.
# Vulnerable Code
File: src/infra/outbound/message-action-params.ts
Method: normalizeSandboxMediaParams
Why: The hardcoded media key list does not include `mediaUrl` or `fileUrl`, so those parameters bypass sandbox path validation.
File: src/infra/outbound/message-action-runner.ts
Method: handlePluginAction
Why: The channel dispatch context omits `mediaLocalRoots`, so downstream plugin media loading can use default roots that cover the broader OpenClaw workspace tree.
# Reproduction
1. Create two agent workspaces, for example Agent-A and Agent-B, under the OpenClaw workspace directory.
2. Place a secret file in Agent-B's workspace.
3. From Agent-A, invoke a message action with a parameter such as `{ "mediaUrl": "/root/.openclaw/workspace/agent-b/secret_key.txt" }`.
4. Observe that `normalizeSandboxMediaParams` does not reject the `mediaUrl` path and the plugin media loader can read the Agent-B file.
5. Compare with the `media` key, which is blocked by sandbox validation when it points outside Agent-A's sandbox.
# Impact
- Sandbox escape between agent workspaces.
- Disclosure of API keys, secrets, logs, session data, and configuration files stored in other agents' workspaces.
- Breaks the intended multi-agent workspace isolation boundary.
Reference Link: https://gist.github.com/YLChen-007/8dab2bac26916a41acf1da5fa4a877eb ; |
|---|
| Fuente | ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg |
|---|
| Usuario | AbamaYouLong (UID 99186) |
|---|
| Sumisión | 2026-07-01 08:28 (hace 3 meses) |
|---|
| Moderación | 2026-08-17 11:45 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 356906 [OpenClaw hasta 2026.3.23 Configuration Data fileUrl recorrido de directorios] |
|---|
| Puntos | 0 |
|---|