Submeter #862450: NanoCoAI NanoClaw 2.0.64 Missing Authentication for Critical Function (CWE-306)

# Technical Details
A local gateway approval bypass exists in the `createChatSdkBridge.setup()` method in `src/channels/chat-sdk-bridge.ts` of NanoClaw.

NanoClaw's Chat SDK gateway bridge starts a localhost-only webhook (`startLocalWebhookServer(...)`) for forwarded interaction events, but the webhook does not authenticate the sender before trusting the `interaction.user.id` embedded in the JSON body. Any local unprivileged process that can connect to `127.0.0.1` can POST a forged interaction event with a spoofed `user.id` matching the expected approver, triggering channel registration into a target agent group.

# Vulnerable Code
File: src/channels/chat-sdk-bridge.ts
Method: `createChatSdkBridge.setup()` → `startLocalWebhookServer()` → `handleForwardedEvent()` (Lines 593-665)
Why: The webhook accepts arbitrary POST bodies, parses them as forwarded gateway events, and for interaction callbacks dispatches `setupConfig.onAction(questionId, selectedOption, user?.id || '')` without any authentication check — no shared secret, no signature validation, no bearer token. The downstream approval handler in `src/modules/permissions/index.ts` (lines 314-327) does authorize based on `payload.userId`, but that identity was already taken from the attacker-controlled request body, making the check ineffective. Upon authorization, the handler creates `messaging_group_agents` wiring, replays the original event, and adds the sender to the target agent group (lines 466-497).

# Reproduction
1. Set up a NanoClaw deployment at version <= 2.0.64 with a gateway-capable adapter path that triggers `createChatSdkBridge.setup()` to start the local loopback webhook.
2. Seed a pending channel approval row in the SQLite database for `mg-attack` with approver `discord:approver-1`.
3. Identify the ephemeral webhook port from the running process.
4. POST a forged interaction event to `http://127.0.0.1:<port>/webhook` with `custom_id = ncq:mg-attack:connect:ag-2` and `user.id = approver-1` — observe HTTP 200 and the pending approval being consumed.
5. Confirm the DB now shows channel registration approved, wiring created, and attacker added as member.
6. Run the control with `user.id = attacker-user` — observe the same payload is rejected, pending approval remains, proving the bypass depends on forged identity.

# Impact
- A local unprivileged process can impersonate the expected approver for pending channel-registration actions.
- Unauthorized channel-to-agent wiring can be forced, causing the original sender to be added to the target agent group.
- Enables exposure of higher-privilege agent workflows, session context, and follow-on tool actions to a local attacker without approval authority.

• Fonte: ⚠️ https://github.com/nanocoai/nanoclaw/issues/2761
• Utilizador: Erichen-x (UID 99082)
• Submissão: 18/06/2026 04h39 (há 1 mês)
• Moderação: 25/07/2026 13h08 (1 month later)
• Estado: Aceite
• Entrada VulDB: 383074 [nanocoai NanoClaw até 2.0.64 MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup Elevação de Privilégios]
• Pontos: 20