| शीर्षक | PicoClaw V0.2.4 Command execution |
|---|
| विवरण | The unauthenticated Web Launcher management plane can directly change the config.json, write any hooks.processes[*].command into it, and then restart the gateway through the unauthenticated POST /api/gateway/restart. When the gateway starts, this command is immediately started as a process hook, forming a stable RCE
This vulnerability can directly result in unauthenticated remote code execution under the following conditions. The target launches picoclaw-launcher -public or the launcher is deployed as an accessible management plane in the same CIDR segment and allowed_cidrs is empty, or the attacker IP is within the allowed range |
|---|
| स्रोत | ⚠️ https://github.com/sipeed/picoclaw/issues/2307 |
|---|
| उपयोगकर्ता | AiSec (UID 97073) |
|---|
| सबमिशन | 03/04/2026 10:49 AM (6 महीनों पहले) |
|---|
| संयम | 24/04/2026 09:16 PM (21 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359530 [PicoClaw तक 0.2.4 Web Launcher Management Plane /api/gateway/restart अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|