| 제목 | mf-yang openclaw-cn 0.2.1 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| 설명 | # Technical Details
An authenticated local file disclosure vulnerability exists in the browser control HTTP API of `openclaw-cn`. The `POST /tabs/open` endpoint accepts a caller-controlled `url` field and forwards it through `openTab()` → `assertBrowserNavigationAllowed()` → `createTargetViaCdp()`. The navigation guard in `src/browser/navigation-guard.ts` only validates `http:` and `https:` schemes and returns early for every other protocol, allowing `file://` URLs to bypass rejection entirely and reach the CDP `Target.createTarget` sink.
# Vulnerable Code
File: src/browser/navigation-guard.ts (Lines 3-27)
Method: `assertBrowserNavigationAllowed()`
Why: The guard checks `if (!NETWORK_NAVIGATION_PROTOCOLS.has(parsed.protocol)) { return; }` — only `http:` and `https:` are in the set, so `file:` (and any other unsupported scheme) returns early without blocking.
File: src/browser/routes/tabs.ts (Lines 30-40)
Method: `POST /tabs/open` route handler
Why: Accepts the attacker-controlled `url` from the request body and forwards it directly to `profileCtx.openTab(url)`.
File: src/browser/server-context.ts (Lines 151-181)
Method: `openTab()`
Why: Retrieves the caller-controlled URL, invokes the incomplete guard, then forwards the same URL into the CDP tab-creation path.
File: src/browser/cdp.ts (Lines 81-105)
Method: `createTargetViaCdp()`
Why: Issues CDP `Target.createTarget` with the original attacker-controlled URL, reaching the real browser sink.
# Reproduction
1. Set up `openclaw-cn` version <= 0.2.1 with the browser control HTTP API enabled and token authentication.
2. Create a canary file at a known path readable by the OpenClaw process (e.g., `/tmp/canary.html`).
3. Send `POST /tabs/open` with `{"url": "file:///tmp/canary.html"}` — observe HTTP 200 with a valid `targetId`.
4. Call `GET /snapshot?targetId=<targetId>` — observe the snapshot JSON contains the canary text from the local file.
5. Run the control case with `{"url": "about:blank"}` — confirm the snapshot does not contain the canary, proving the leak depends on the unsupported `file:` scheme bypass.
# Impact
- Any authenticated browser-control caller can cause the managed Chrome instance to render local files readable by the OpenClaw process user.
- Enables recovery of rendered text from local HTML reports, temporary files, exported debugging artifacts, or other browser-readable local content.
- Breaks the intended navigation safety boundary and exposes host-local data through a documented HTTP API.
- Impact bounded by the product's trusted-operator model but still breaks navigation isolation guarantees. |
|---|
| 원천 | ⚠️ https://github.com/mf-yang/openclaw-cn/issues/561 |
|---|
| 사용자 | Erichen-x (UID 99082) |
|---|
| 제출 | 2026. 06. 18. AM 04:40 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 25. PM 08:54 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 383319 [mf-yang openclaw-cn 까지 0.2.1 Scheme navigation-guard.ts assertBrowserNavigationAllowed url 정보 공개] |
|---|
| 포인트들 | 20 |
|---|