| Title | nanocoai NanoClaw 2.0.64 Missing Authentication for Critical Function (CWE-306) |
|---|
| Description | # Technical Details
A Local Gateway Approval Bypass via Unauthenticated Loopback Webhook exists in `handleForwardedEvent()` in `src/channels/chat-sdk-bridge.ts` of NanoClaw.
The application fails to authenticate the sender of loopback webhook events before trusting `interaction.user.id`. The Chat SDK bridge starts a localhost-only webhook that accepts arbitrary POST bodies and dispatches interaction callbacks via `setupConfig.onAction(questionId, selectedOption, user?.id || '')` without checking the sender's identity. Any local unprivileged process can forge an approval click as the expected approver. The downstream authorization handler checks whether the clicker matches the stored approver, but its input (`payload.userId`) comes from the unauthenticated upstream boundary.
# Vulnerable Code
File: src/channels/chat-sdk-bridge.ts
Method: handleForwardedEvent() (lines ~593-665) — parses arbitrary POST body JSON, extracts interaction.user.id, and forwards body-supplied identity into onAction() without sender authentication
Why: No shared secret, signature, or bearer token validation on the loopback webhook endpoint. The downstream permission check trusts the unauthenticated caller-supplied user identity.
# Reproduction
1. Seed a pending channel approval for a messaging group with a known approver.
2. Start the Chat SDK bridge, which creates an ephemeral localhost webhook.
3. POST a forged interaction event with `custom_id = ncq:<mg>:connect:<ag>` and `user.id = <approver_id>`.
4. Observe the channel registration is approved, the messaging-group wiring is created, and the sender is added to the agent group.
5. Confirm the same request with `user.id = attacker-user` is rejected.
# Impact
- Local unprivileged process can impersonate the expected approver for pending channel-registration actions.
- Forces unauthorized channel-to-agent wiring, exposing higher-privilege agent workflows and session context.
- Enables follow-on tool actions by adding unauthorized members to agent groups. |
|---|
| Source | ⚠️ https://github.com/nanocoai/nanoclaw/issues/2761 |
|---|
| User | JohnChen (UID 99088) |
|---|
| Submission | 06/18/2026 08:55 (2 months ago) |
|---|
| Moderation | 08/05/2026 20:48 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 383074 [nanocoai NanoClaw up to 2.0.64 MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization] |
|---|
| Points | 0 |
|---|