| शीर्षक | nextlevelbuilder goclaw <= v3.11.3 Improper Authorization (CWE-285) |
|---|
| विवरण | # Technical Details
An Evolution Suggestion Authorization Bypass exists in the `PATCH /v1/agents/{agentID}/evolution/suggestions/{suggestionID}` endpoint in `internal/http/evolution_handlers.go` of goclaw.
The application fails to set an explicit role requirement in the access control middleware, using `requireAuth("", next)` which dynamically resolves to `RoleOperator` for PATCH. Gateway Tokens forcibly elevate users to `RoleAdmin` for the request context, bypassing this check. Furthermore, the endpoint lacks tenant-level admin verification checks, allowing unauthenticated or low-privilege users (e.g., Viewers) to approve, reject, or modify system-generated Evolution Suggestions.
# Vulnerable Code
File: internal/http/evolution_handlers.go
Method: auth
Why: The handler incorrectly sets an empty minimum role `requireAuth("", next)`, which auto-resolves to the weak `RoleOperator` for the HTTP PATCH method and gets bypassed by gateway tokens without secondary tenant checks.
# Reproduction
1. Start up the GoClaw environment with the standard Gateway Token mechanism.
2. Ensure there is a pending system-generated evolution suggestion in the database (e.g., `tool_order` suggestion).
3. Issue a `PATCH` HTTP request against the endpoint using a low privilege (Viewer) identity.
4. Observe that the low privilege identity successfully approves or rejects the suggestion.
# Impact
- Administrative Privilege Escalation via the Gateway Token dynamic role assumption gap.
- Attackers with only `Viewer` permissions can deny important structural configuration tuning requests, apply untested threshold changes, or forcefully disable Built-in capability tools, causing significant functional degradations (Denial of Service) globally for all users. |
|---|
| स्रोत | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1120 |
|---|
| उपयोगकर्ता | Eric-b (UID 96354) |
|---|
| सबमिशन | 07/05/2026 01:51 PM (28 दिन पहले) |
|---|
| संयम | 31/05/2026 09:41 AM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 367497 [nextlevelbuilder GoClaw तक 3.11.3 evolution_handlers.go auth अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|