| 제목 | nextlevelbuilder GoClaw 3.13.3-beta.3 Authorization Bypass (CWE-285) |
|---|
| 설명 | # Technical Details
An Authorization Bypass exists in the `detectWrapper` and secure-CLI gate path used by `ExecTool.Execute` in `goclaw/internal/tools/credentialed_exec.go` of GoClaw.
The application fails to recognize PowerShell wrappers such as `pwsh -EncodedCommand` when unwrapping commands for secure-CLI enforcement. Because `pwsh` and `powershell` are omitted from `wrapperBinaries`, a registered high-risk CLI can be hidden inside encoded PowerShell text and bypass the intended grant check.
# Vulnerable Code
File: goclaw/internal/tools/credentialed_exec.go
Method: detectWrapper / collectGateCandidates / ExecTool.Execute
Why: The secure-CLI gate denies only binaries discovered through wrapper unwrapping. PowerShell wrappers are not treated as wrappers, so the protected inner binary never appears in the candidate list and no grant is enforced.
# Reproduction
1. Download `verification_harness.go`, `verification_test.py`, and `control-normal-behavior.py` from the issue-linked gists.
2. Place the files together and, from the repository root, run `python3 llm-enhance/cve-finding/similar/Auth_Bypass/GHSA-3h2q-j2v4-6w5r-powershell-secure-cli-wrapper-exp/verification_test.py`.
3. Observe that a registered secure CLI such as `gh` executes through `pwsh -EncodedCommand` without the intended secure-CLI grant.
# Impact
- Authenticated operator-level callers or agents can execute protected credentialed CLIs without approval.
- This can expose repository administration, cloud, cluster, release, or other privileged automation capabilities behind the wrapped CLI. |
|---|
| 원천 | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1215 |
|---|
| 사용자 | Eric-x (UID 94869) |
|---|
| 제출 | 2026. 06. 13. AM 05:06 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 18. AM 09:24 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 380015 [nextlevelbuilder GoClaw 까지 3.13.3-beta.3 credentialed_exec.go ExecTool.Execute 권한 상승] |
|---|
| 포인트들 | 20 |
|---|