提交 #862537: unitedbyai DroidClaw 0.5.3 Authorization Bypass Through User-Controlled Key (CWE-639)

# Technical Details
A Cross-Device Session Rebinding vulnerability exists in the `POST /goals/execute` route handler in `server/src/routes/goals.ts` of DroidClaw.

The application fails to enforce the stored session owner and stored target device when resuming a scheduled callback. The callback route validates only that the referenced `agent_session.id` exists and is not cancelled, but trusts attacker-controlled `deviceId` and `userId` fields from the callback body without reloading and enforcing the persisted `agent_session.userId` or `agent_session.deviceId`. When `QSTASH_CURRENT_SIGNING_KEY` is unset, the route accepts unsigned JSON, allowing an attacker who knows a valid scheduled `sessionId` to submit a forged callback redirecting execution onto any online device.

# Vulnerable Code
File: server/src/routes/goals.ts
Method: goals.post("/execute") handler — validates sessionId existence only, then selects online device by body.deviceId and loads LLM config by body.userId
Why: The handler trusts caller-supplied deviceId and userId without cross-referencing the stored agent_session record. The core authorization check (matching stored session owner and device to callback-supplied values) is missing entirely.

# Reproduction
1. Deploy DroidClaw with `QSTASH_CURRENT_SIGNING_KEY` unset.
2. Seed a scheduled `agent_session` for an attacker user/device pair.
3. Connect both an attacker device and a victim device via `/ws/device`.
4. Send a forged `POST /goals/execute` request with `sessionId=session-attacker-scheduled`, `deviceId=device-victim`, `userId=user-attacker`.
5. Observe that `open_settings` is delivered to the victim device WebSocket instead of the attacker's original device.

# Impact
- Cross-device command execution: an attacker can redirect stored scheduled sessions onto victim devices.
- The vulnerable path is the same `runPipeline(...)` path used for broader device automation, not limited to `open_settings`.
- An attacker can cause DroidClaw to execute goal-derived commands on a victim's phone through the legitimate device-control channel.

• 来源: ⚠️ https://github.com/unitedbyai/droidclaw/issues/18
• 用户: Erichen-apple (UID 99087)
• 提交: 2026-06-18 08時32分 (1 月前)
• 管理: 2026-07-27 10時50分 (1 month later)
• 状态: 已接受
• VulDB条目: 383396 [unitedbyai droidclaw 直到 0.5.3 Unsigned Scheduled Callback goals.ts 权限提升]
• 积分: 20