提出 #862683: unitedbyai DroidClaw 0.5.3 Authorization Bypass Through User-Controlled Key (CWE-639)

# Technical Details
A Cross-Device Session Rebinding vulnerability exists in the `POST /goals/execute` scheduled-goal callback handler in `server/src/routes/goals.ts` of DroidClaw.

The application fails to enforce the stored session's owner and target device when resuming a scheduled callback. The handler validates only that `sessionId` exists and is not cancelled, then trusts caller-supplied `deviceId` and `userId` from the unsigned callback body to select the online WebSocket target and LLM configuration. When `QSTASH_CURRENT_SIGNING_KEY` is unset, the route skips signature verification entirely, accepting arbitrary JSON. An attacker who knows a valid scheduled `sessionId` can forge a callback that redirects execution onto a victim's connected device.

# Vulnerable Code
File: server/src/routes/goals.ts
Method: goals.post("/execute") handler
Why: The handler performs only a session existence check (status != cancelled) but never reloads and enforces the stored agent_session.userId or agent_session.deviceId. It then passes attacker-controlled deviceId, userId, and goal directly into runPipeline(...), allowing cross-device session rebinding.

# Reproduction
1. Deploy DroidClaw with QSTASH_CURRENT_SIGNING_KEY unset so the callback route accepts unsigned JSON.
2. Seed a scheduled agent_session for the attacker user and connect both attacker and victim devices via /ws/device.
3. Send a forged POST /goals/execute with attacker's sessionId but victim's deviceId: `curl -X POST http://127.0.0.1:18080/goals/execute -H 'Content-Type: application/json' -d '{"sessionId":"session-attacker-scheduled","deviceId":"device-victim","userId":"user-attacker","goal":"open wifi settings"}'`
4. Observe the server delivers the goal-derived command (e.g., open_settings) to the victim device WebSocket instead of the attacker's device.

# Impact
- Cross-device command execution: attacker can redirect stored scheduled sessions onto victim's connected device
- Attacker can cause DroidClaw to execute goal-derived commands on a victim's phone through the legitimate device-control channel
- The vulnerable path is the same path used to drive broader device automation through runPipeline(...)

• ソース: ⚠️ https://github.com/unitedbyai/droidclaw/issues/18
• ユーザー: JondaChen (UID 99096)
• 送信: 2026年06月18日 11:12 (2 月 ago)
• モデレーション: 2026年08月05日 23:32 (2 months later)
• ステータス: 重複
• VulDBエントリ: 383396 [unitedbyai droidclaw 迄 0.5.3 Unsigned Scheduled Callback goals.ts 特権昇格]
• ポイント: 0