| 제목 | nextlevelbuilder GoClaw 3.13.3-beta.3 Server-Side Request Forgery (CWE-918) |
|---|
| 설명 | # Technical Details
A Server-Side Request Forgery exists in the `bytePlusDownloadVideo` method in `internal/tools/create_video_byteplus.go` of GoClaw.
The application fails to apply the product's SSRF protections to provider-returned media URLs. An authenticated operator can invoke `POST /v1/tools/invoke` and trigger the `create_video` workflow. If the upstream provider returns a malicious `output.video_url`, GoClaw fetches that URL with a plain `http.Client` from the gateway host itself. The issue also affects the same provider-returned download pattern in `internal/tools/create_video_gemini.go` and `internal/tools/create_video_minimax.go`.
# Vulnerable Code
File: internal/tools/create_video_byteplus.go
Method: bytePlusDownloadVideo
Why: After task success, the code reads `taskResp.Output.VideoURL` and downloads it with `http.NewRequestWithContext(..., videoURL, nil)` and `client.Do(req)` instead of using SSRF validation like `CheckSSRF(...)` and pinned-IP dialing used elsewhere such as `internal/tools/web_fetch.go`.
# Reproduction
1. Configure a vulnerable GoClaw instance on version `3.13.3-beta.3` with the `create_video` tool enabled and point it at a controlled or malicious video provider.
2. Invoke `POST /v1/tools/invoke` for `create_video` so the provider returns a crafted `video_url` such as a loopback or internal-network endpoint.
3. Observe that the GoClaw server fetches the attacker-chosen internal URL from the gateway host during media download.
# Impact
- Authenticated operators can coerce the gateway into fetching loopback, private-network, or metadata URLs.
- Internal HTTP responses, admin panels, and other non-public network resources may become reachable from the server's network position. |
|---|
| 원천 | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1199 |
|---|
| 사용자 | Eric-b (UID 96354) |
|---|
| 제출 | 2026. 06. 11. AM 09:10 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 13. PM 07:23 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 378126 [nextlevelbuilder GoClaw 3.13.3-beta.3 invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo output.video_url 권한 상승] |
|---|
| 포인트들 | 20 |
|---|