Soumettre #862537: unitedbyai DroidClaw 0.5.3 Authorization Bypass Through User-Controlled Key (CWE-639)

# Technical Details
A Cross-Device Session Rebinding vulnerability exists in the `POST /goals/execute` route handler in `server/src/routes/goals.ts` of DroidClaw.

The application fails to enforce the stored session owner and stored target device when resuming a scheduled callback. The callback route validates only that the referenced `agent_session.id` exists and is not cancelled, but trusts attacker-controlled `deviceId` and `userId` fields from the callback body without reloading and enforcing the persisted `agent_session.userId` or `agent_session.deviceId`. When `QSTASH_CURRENT_SIGNING_KEY` is unset, the route accepts unsigned JSON, allowing an attacker who knows a valid scheduled `sessionId` to submit a forged callback redirecting execution onto any online device.

# Vulnerable Code
File: server/src/routes/goals.ts
Method: goals.post("/execute") handler — validates sessionId existence only, then selects online device by body.deviceId and loads LLM config by body.userId
Why: The handler trusts caller-supplied deviceId and userId without cross-referencing the stored agent_session record. The core authorization check (matching stored session owner and device to callback-supplied values) is missing entirely.

# Reproduction
1. Deploy DroidClaw with `QSTASH_CURRENT_SIGNING_KEY` unset.
2. Seed a scheduled `agent_session` for an attacker user/device pair.
3. Connect both an attacker device and a victim device via `/ws/device`.
4. Send a forged `POST /goals/execute` request with `sessionId=session-attacker-scheduled`, `deviceId=device-victim`, `userId=user-attacker`.
5. Observe that `open_settings` is delivered to the victim device WebSocket instead of the attacker's original device.

# Impact
- Cross-device command execution: an attacker can redirect stored scheduled sessions onto victim devices.
- The vulnerable path is the same `runPipeline(...)` path used for broader device automation, not limited to `open_settings`.
- An attacker can cause DroidClaw to execute goal-derived commands on a victim's phone through the legitimate device-control channel.

• La source: ⚠️ https://github.com/unitedbyai/droidclaw/issues/18
• Utilisateur: Erichen-apple (UID 99087)
• Soumission: 18/06/2026 08:32 (il y a 1 mois)
• Modérer: 27/07/2026 10:50 (1 month later)
• Statut: Accepté
• Entrée VulDB: 383396 [unitedbyai droidclaw jusqu’à 0.5.3 Unsigned Scheduled Callback goals.ts élévation de privilèges]
• Points: 20