提出 #862567: mf-yang openclaw-cn 0.2.1 Server-Side Request Forgery (CWE-918)

# Technical Details
A Browser Interaction-Driven SSRF Policy Bypass exists in the `/act` click route in `src/browser/routes/agent.act.ts` of openclaw-cn.

The application fails to re-validate the final URL after a navigation-capable click action. Direct navigation via `POST /navigate` is protected by `assertBrowserNavigationAllowed()` with SSRF policy enforcement. However, the `/act` click route forwards click requests to `clickViaPlaywright()` without any `ssrfPolicy` plumbing or post-click destination validation. An attacker can load attacker-controlled HTML via a benign `data:` URL, obtain a clickable link ref via `/snapshot`, and click it via `/act` to navigate the browser to a loopback/private target. The content can then be read back via `/snapshot`.

# Vulnerable Code
File: src/browser/routes/agent.act.ts (lines ~64-80)
Method: /act click handler — builds click request and forwards to clickViaPlaywright() without SSRF policy or post-click destination validation
File: src/browser/pw-tools-core.interactions.ts (lines ~26-55)
Method: clickViaPlaywright() — resolves attacker-controlled ref and calls locator.click() directly with no navigation revalidation
Why: Security boundary is inconsistent between explicit navigation (protected by assertBrowserNavigationAllowed) and interaction-driven navigation (no SSRF revalidation after click).

# Reproduction
1. Start browser-control server with `browser.ssrfPolicy.allowPrivateNetwork=false`.
2. Start a loopback canary HTTP server.
3. Verify direct `POST /navigate` to the canary URL returns 400 "Blocked: private/internal IP address".
4. Navigate to a `data:` page containing a link to the loopback canary URL.
5. `GET /snapshot` to obtain the clickable ref, then `POST /act` to click it.
6. Confirm the browser lands on the blocked loopback target and `GET /snapshot` exposes the canary content.

# Impact
- SSRF-style private-network access control bypass in the browser-control subsystem.
- Authenticated caller can use the controlled browser as a read-capable pivot into loopback or private HTTP resources.
- Exposes localhost-only admin/debug endpoints, private-network dashboards, and metadata services that the SSRF policy was supposed to block.

• ソース: ⚠️ https://github.com/mf-yang/openclaw-cn/issues/562
• ユーザー: JohnChen (UID 99088)
• 送信: 2026年06月18日 08:56 (2 月 ago)
• モデレーション: 2026年08月05日 20:52 (2 months later)
• ステータス: 重複
• VulDBエントリ: 383320 [mf-yang openclaw-cn 迄 0.2.1 Browser Control HTTP API agent.act.ts clickViaPlaywright 特権昇格]
• ポイント: 0