Отправить #862642: mf-yang openclaw-cn 2026.2.5 Incorrect Authorization (CWE-863)

# Technical Details
An Incorrect Authorization vulnerability exists in OpenClaw's gateway exec approval flow. In `src/agents/bash-tools.exec.ts`, when an operator grants `allow-always` for a command, the code stores each parsed segment's resolved executable path via `addAllowlistEntry()`. For `busybox sh -c '...'` commands, the resolved path is the `busybox` multiplexer binary, not the shell applet payload. Later, in `src/infra/exec-approvals.ts`, the allowlist matcher checks the candidate executable path for each segment. A reused `busybox` path can satisfy the allowlist even when the `sh -c` payload has changed. Direct shells like `sh` and `bash` are unwrapped, but shell multiplexers like `busybox` and `toybox` are not treated as wrappers before persisting the allow-always pattern.

# Vulnerable Code
File: src/agents/bash-tools.exec.ts (lines 1247-1255)
Method: resolveAllowAlwaysPatterns() / allow-always persistence
Why: The `allow-always` decision persists each parsed segment's resolved executable path, which binds trust to the outer `busybox` wrapper path rather than the specific shell payload.

File: src/infra/exec-approvals.ts (lines 893-900)
Method: allowlist evaluation
Why: Later allowlist evaluation checks the candidate executable path for each segment; a reused `busybox` path can satisfy the allowlist even when the shell payload changed.

File: src/infra/exec-approvals.ts (lines 507-519)
Method: allowlist matcher
Why: The allowlist matcher accepts path-pattern matches against the resolved executable path without binding the approved shell wrapper to the approved inline command payload.

# Reproduction
1. Configure gateway exec tool with `security: "allowlist"` and `ask: "on-miss"`.
2. Send a `busybox sh -c` command and approve it with `allow-always`.
3. Send a second `busybox sh -c` command with a different payload.
4. Observe only one `exec.approval.request` was emitted; the second command reaches the allowlist-satisfied path without a second approval.
5. Confirm the control case (no allow-always) correctly blocks the command.

# Impact
- Approval bypass in the exec allowlist boundary.
- An authenticated gateway caller who obtains one `allow-always` for `busybox sh -c` can avoid later approval prompts for different payloads.
- Weakens OpenClaw's high-risk exec approval boundary and can let later command attempts proceed without operator visibility.

• Источник: ⚠️ https://github.com/mf-yang/openclaw-cn/issues/563
• Пользователь: TrumpChen (UID 99092)
• Представление: 18.06.2026 09:58 (2 месяцы назад)
• Модерация: 05.08.2026 22:04 (2 months later)
• Статус: принято
• Запись VulDB: 386389 [mf-yang openclaw-cn 2026.2.5 Ggateway Exec Approval Flow bash-tools.exec.ts эскалация привилегий]
• Баллы: 20