提出 #862643: mf-yang openclaw-cn 0.2.1 Improper Privilege Management (CWE-269)

# Technical Details
An Improper Privilege Management vulnerability exists in OpenClaw's `/elevated` directive authorization path. In `src/auto-reply/reply/reply-elevated.ts`, `isApprovedElevatedSender()` builds a token set from several `MsgContext` fields to compare against configured `tools.elevated.allowFrom.<provider>` entries. The bug is that this token set mixes stable sender identity with unrelated or weak-trust fields including `ctx.To` (recipient), `SenderName`, `SenderUsername`, and `SenderTag` (mutable profile metadata). Because unprefixed allowlist entries are compared against the entire token set, a sender can be incorrectly approved when the allowlist matches the recipient address or mutable display name rather than the actual sender identity. The result is consumed in `src/auto-reply/reply/get-reply-directives.ts` where an incorrectly computed `elevatedAllowed=true` causes `/elevated on` to be accepted.

# Vulnerable Code
File: src/auto-reply/reply/reply-elevated.ts (lines 50-95)
Method: isApprovedElevatedSender()
Why: The approval token set adds `ctx.To`, `SenderName`, `SenderUsername`, and `SenderTag` into the same default-matching pool as stable sender identifiers, enabling recipient-token and mutable-metadata bypasses.

File: src/auto-reply/reply/get-reply-directives.ts (lines 307-334)
Method: resolveReplyDirectives()
Why: When the flawed elevated authorization incorrectly returns true, the `/elevated` directive is accepted and the session's `elevatedLevel` is updated instead of being rejected.

# Reproduction
1. Configure `tools.elevated.allowFrom.whatsapp=["[phone]"]` where the actual sender is `[phone]`.
2. Set `ctx.To="[phone]"` (recipient matches allowlist, sender does not).
3. Send `/elevated on` — observe elevated mode is enabled despite sender mismatch.
4. Configure `tools.elevated.allowFrom.whatsapp=["owner-display-name"]` with a different sender identity.
5. Set `SenderName="owner-display-name"` — observe elevated mode is enabled via mutable metadata.
6. Confirm control cases with non-matching values correctly deny elevated access.

# Impact
- Improper privilege management in the chat control plane.
- A command-authorized but non-elevated sender can activate elevated mode by matching recipient routing or mutable sender metadata.
- In deployments where elevated mode unlocks stronger execution, approvals, or host-side actions, lower-privileged users cross into more sensitive execution state.
- Breaks the intended security boundary between general chat users and elevated-mode operators.

• ソース: ⚠️ https://github.com/mf-yang/openclaw-cn/issues/564
• ユーザー: TrumpChen (UID 99092)
• 送信: 2026年06月18日 09:58 (2 月 ago)
• モデレーション: 2026年08月05日 22:04 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 386390 [mf-yang openclaw-cn 迄 0.2.1 reply-elevated.ts isApprovedElevatedSender 特権昇格]
• ポイント: 20