| 标题 | nextlevelbuilder goclaw <= v3.11.3 Improper Authorization (CWE-285) |
|---|
| 描述 | # Technical Details
An Evolution Suggestion Authorization Bypass exists in the `PATCH /v1/agents/{agentID}/evolution/suggestions/{suggestionID}` endpoint in `internal/http/evolution_handlers.go` of goclaw.
The application fails to set an explicit role requirement in the access control middleware, using `requireAuth("", next)` which dynamically resolves to `RoleOperator` for PATCH. Gateway Tokens forcibly elevate users to `RoleAdmin` for the request context, bypassing this check. Furthermore, the endpoint lacks tenant-level admin verification checks, allowing unauthenticated or low-privilege users (e.g., Viewers) to approve, reject, or modify system-generated Evolution Suggestions.
# Vulnerable Code
File: internal/http/evolution_handlers.go
Method: auth
Why: The handler incorrectly sets an empty minimum role `requireAuth("", next)`, which auto-resolves to the weak `RoleOperator` for the HTTP PATCH method and gets bypassed by gateway tokens without secondary tenant checks.
# Reproduction
1. Start up the GoClaw environment with the standard Gateway Token mechanism.
2. Ensure there is a pending system-generated evolution suggestion in the database (e.g., `tool_order` suggestion).
3. Issue a `PATCH` HTTP request against the endpoint using a low privilege (Viewer) identity.
4. Observe that the low privilege identity successfully approves or rejects the suggestion.
# Impact
- Administrative Privilege Escalation via the Gateway Token dynamic role assumption gap.
- Attackers with only `Viewer` permissions can deny important structural configuration tuning requests, apply untested threshold changes, or forcefully disable Built-in capability tools, causing significant functional degradations (Denial of Service) globally for all users. |
|---|
| 来源 | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1120 |
|---|
| 用户 | Eric-b (UID 96354) |
|---|
| 提交 | 2026-05-07 13時51分 (1 月前) |
|---|
| 管理 | 2026-05-31 09時41分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 367497 [nextlevelbuilder GoClaw 直到 3.11.3 evolution_handlers.go auth 权限提升] |
|---|
| 积分 | 20 |
|---|