提出 #922881: NetEase Youdao LobsterAI (lobsterai) 2026.6.15 Server-Side Request Forgery (CWE-918)

# Technical Details
An SSRF / private-network browser access vulnerability exists in the `buildBrowserConfig` method in `src/main/libs/openclawConfigSync.ts` of LobsterAI.

LobsterAI's browser settings layer defaults to `ProxyCompatible` mode: `defaultBrowserWebAccessConfig` sets `networkMode: BrowserNetworkMode.ProxyCompatible`, and `normalizeBrowserWebAccessConfig()` falls back to that permissive default whenever no explicit browser policy is stored. `OpenClawConfigSync.buildBrowserConfig()` then maps every non-strict mode into the managed OpenClaw runtime config as `browser.ssrfPolicy.dangerouslyAllowPrivateNetwork = true`, re-enabling private-network browser access by default. Because the bundled prompt policy instructs every `browser` tool call to run with `target="host"` (and to retry with `target="host"` if the sandbox browser is unavailable), browser activity is routed through the host network namespace. A local user or a reachable IM sender (e.g., a Telegram account with `dmPolicy: 'open'`, which serializes `allowFrom = ["*"]`) can therefore influence Cowork into navigating to `localhost` and RFC1918 private-network destinations without the user explicitly switching the browser network mode to `Strict`.

# Vulnerable Code
File: src/shared/browserWebAccess/constants.ts
Method: defaultBrowserWebAccessConfig / normalizeBrowserWebAccessConfig()
Why: The default config sets `networkMode: BrowserNetworkMode.ProxyCompatible` (permissive), and the normalize function falls back to this default instead of forcing strict mode when no browser setting is stored.

File: src/main/libs/openclawConfigSync.ts
Method: buildBrowserConfig()
Why: `const ssrfPolicy = browserWebAccess.networkMode === BrowserNetworkMode.Strict ? { dangerouslyAllowPrivateNetwork: false, ... } : { dangerouslyAllowPrivateNetwork: true, ... }` — every non-strict mode writes the dangerous private-network opt-in into the managed OpenClaw runtime config.

File: src/main/libs/openclawConfigSync.ts
Method: managed browser prompt policy (target="host")
Why: The policy forces browser tool calls to use `target="host"`, making the relaxed SSRF policy apply to the victim host's network context (localhost / LAN services).

# Reproduction
1. Check out `netease-youdao/LobsterAI` at a release between 2026.5.22 and 2026.6.15 (commit 5351d1ec650325b6a107a99704a1e5415de9097d) with `python3` and `node` available.
2. Ensure the compiled artifact exists: `test -f dist-electron/main/libs/openclawConfigSync.js` (if missing, run `npm run compile:electron` on a supported Node 24 host).
3. Download and run the verification driver `verification_test.py` alongside `openclaw_config_sync_harness.js` and `control-explicit-strict.py`.
4. Confirm the vulnerable output reports: `browser.ssrfPolicy.dangerouslyAllowPrivateNetwork = true`, `telegram allowFrom = ["*"]`, and AGENTS browser policy enforces `target="host"`.
5. Run the control case `control-explicit-strict.py` and confirm it flips only the SSRF flag to `false` while the same host-target policy remains.

# Impact
- Browser SSRF / private-network exposure caused by an unsafe default; the default product behavior removes a meaningful network boundary users would expect to be strict.
- Exposure of localhost-only admin panels and developer tools, internal dashboards and private web applications on RFC1918 networks, and services bound to loopback/internal interfaces that trust network location as partial access control.
- Reachable by any local Cowork prompt, shared workspace instruction, or reachable IM sender that can influence a browser action.
- Severity: Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

• ソース: ⚠️ https://github.com/netease-youdao/LobsterAI/issues/2181
• ユーザー: Eric-a (UID 96353)
• 送信: 2026年08月11日 15:19 (1 月 ago)
• モデレーション: 2026年09月13日 20:48 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 403321 [netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4 Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig 特権昇格]
• ポイント: 20