| 标题 | Sipeed PicoClaw <= v0.2.9 Missing Authorization (CWE-862) |
|---|
| 描述 | # Technical Details
A missing authorization vulnerability exists in Feishu reply-context expansion in `pkg/channels/feishu/feishu_64.go` and `pkg/channels/feishu/feishu_reply.go` of PicoClaw.
The application fails to re-check `allow_from` for fetched parent/replied messages. The current Feishu event sender is authorized, but `prependReplyContext` fetches the replied message and prepends its body into downstream model input without validating the parent message sender.
# Vulnerable Code
File: `pkg/channels/feishu/feishu_64.go`
Method: `handleMessageReceive`
Why: Applies `IsAllowedSender` only to the live sender, then calls `prependReplyContext` for replies/threads.
File: `pkg/channels/feishu/feishu_reply.go`
Method: `prependReplyContext`
Why: Resolves and fetches the target message, reads `repliedMessage.Body.Content`, and prepends it without checking whether the parent sender is allowlisted.
# Reproduction
1. Configure Feishu `allow_from` to allow user Alice but not user Mallory.
2. Have Mallory create a group message containing `CANARY_UNTRUSTED_PARENT`.
3. Have Alice reply to Mallory's message with normal allowed content.
4. Observe PicoClaw imports Mallory's parent content into the inbound model context.
5. Run a control where the parent is allowlisted and observe expected allowed behavior.
# Impact
- Bypasses the configured Feishu sender trust boundary.
- Lets non-allowlisted users inject historical message content into trusted agent/model input.
- Can influence downstream tool use, reasoning, or automation decisions that operators intended to restrict to trusted senders. |
|---|
| 来源 | ⚠️ https://github.com/sipeed/picoclaw/issues/3082 |
|---|
| 用户 | Eric-i (UID 97584) |
|---|
| 提交 | 2026-06-09 13時33分 (1 月前) |
|---|
| 管理 | 2026-07-18 09時22分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 380013 [Sipeed PicoClaw 直到 0.2.9 Group Message feishu_64.go handleMessageReceive 权限提升] |
|---|
| 积分 | 20 |
|---|