| 标题 | mf-yang openclaw-cn 0.2.1 Server-Side Request Forgery (CWE-918) |
|---|
| 描述 | # Technical Details
An SSRF-style private-network access control bypass exists in the browser-control HTTP API of `openclaw-cn`. While direct `POST /navigate` requests are properly gated by `assertBrowserNavigationAllowed()` and respect `browser.ssrfPolicy.allowPrivateNetwork=false`, the `/act` click interaction path (`clickViaPlaywright()`) does not re-validate the final URL after a navigation-capable click. An authenticated caller can load attacker-controlled HTML, use `/snapshot` to obtain a clickable ref linking to a loopback/private address, then use `/act` to click that link — the browser navigates to the blocked target and the content can be read back via `/snapshot`.
# Vulnerable Code
File: src/browser/routes/agent.act.ts (Lines 64-80)
Method: `POST /act` route handler
Why: The `/act` route builds a click request and forwards it to `clickViaPlaywright()` without including any `ssrfPolicy` plumbing or post-click destination validation.
File: src/browser/pw-tools-core.interactions.ts (Lines 26-55)
Method: `clickViaPlaywright()`
Why: Resolves the attacker-controlled ref and calls `locator.click()` directly, allowing the browser to follow a loopback/private link with no navigation revalidation.
File: src/browser/pw-tools-core.snapshot.ts (Lines 160-178)
Method: `navigateViaPlaywright()`
Why: This is the direct navigation path that properly enforces `assertBrowserNavigationAllowed()`, demonstrating the intended SSRF protection — but the interaction path lacks equivalent enforcement.
# Reproduction
1. Set up `openclaw-cn` version <= 0.2.1 with browser-control API enabled and `browser.ssrfPolicy.allowPrivateNetwork=false`.
2. Start a loopback canary HTTP server on `127.0.0.1:<port>`.
3. Verify that direct `POST /navigate` to `http://127.0.0.1:<port>/` returns `400` with `"error": "Blocked: private/internal IP address"`.
4. Navigate to a `data:` page containing a link to the same loopback canary URL.
5. Call `GET /snapshot?format=ai&interactive=1&compact=1` to obtain clickable refs.
6. Send `POST /act {"kind":"click","ref":"e1"}` to click the loopback link.
7. Call `GET /snapshot?format=ai` — confirm the post-click URL is the blocked loopback address and the snapshot contains the canary content.
8. Run the control case confirming direct navigation is blocked as expected, proving the bypass is specific to the interaction path.
# Impact
- Authenticated browser-control callers can use the controlled browser as a read-capable pivot into loopback/private HTTP resources.
- Exposes localhost-only admin/debug HTTP endpoints and private-network dashboards that should be protected by SSRF policy.
- Breaks the documented defense provided by `browser.ssrfPolicy.allowPrivateNetwork=false`.
- Impact bounded by trusted-operator model but undermines browser automation isolation guarantees. |
|---|
| 来源 | ⚠️ https://github.com/mf-yang/openclaw-cn/issues/562 |
|---|
| 用户 | Erichen-x (UID 99082) |
|---|
| 提交 | 2026-06-18 04時40分 (1 月前) |
|---|
| 管理 | 2026-07-25 20時54分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 383320 [mf-yang openclaw-cn 直到 0.2.1 Browser Control HTTP API agent.act.ts clickViaPlaywright 权限提升] |
|---|
| 积分 | 20 |
|---|