| Titre | nextlevelbuilder GoClaw 3.13.3-beta.3 Information Disclosure (CWE-200) |
|---|
| Description | # Technical Details
An Information Disclosure vulnerability exists in the `handleNavigate` method in `pkg/browser/tool.go` of GoClaw.
The application fails to restrict browser navigation schemes. Through the authenticated `POST /v1/tools/invoke` browser path, `pkg/browser/tool.go` reads `args.targetUrl` and only checks that it is non-empty, while `pkg/browser/browser_page.go` passes the value directly to Rod's `page.Navigate(url)` without a scheme allowlist. An operator can navigate to `file://` URLs and then read the file contents back through the normal browser primitives `snapshot` or `act.evaluate`.
# Vulnerable Code
File: pkg/browser/tool.go
Method: handleNavigate
Why: The browser tool accepts attacker-controlled `targetUrl` and forwards it to `pkg/browser/browser_page.go`, which calls navigation on the supplied URL without blocking `file://`. The same session can then use `act.evaluate` to read `document.body.innerText` from the loaded local file.
# Reproduction
1. Run GoClaw `3.13.3-beta.3` with the `browser` tool enabled and a reachable Chrome/Chromium CDP endpoint.
2. Use `POST /v1/tools/invoke` with `tool=browser`, `action=navigate`, and `args.targetUrl=file:///path/to/readable/local/file`.
3. Use `snapshot` or `act.evaluate` on the same tab and observe the local file contents in the response.
# Impact
- Authenticated operators can disclose arbitrary local files readable by the browser process account.
- Sensitive configuration, logs, workspace data, tokens written to disk, and other local artifacts may be exposed. |
|---|
| La source | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1207 |
|---|
| Utilisateur | Eric-e (UID 97581) |
|---|
| Soumission | 11/06/2026 10:38 (il y a 1 mois) |
|---|
| Modérer | 13/07/2026 19:24 (1 month later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 378129 [nextlevelbuilder GoClaw jusqu’à 3.13.3-beta.3 pkg/browser/tool.go handleNavigate args.targetUrl divulgation d'information] |
|---|
| Points | 20 |
|---|