T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/send_message.py:20
- Finding
- Overbroad Loading of Sensitive OpenClaw Environment Files## Vulnerability Details **File Location**: `scripts/send_message.py`, lines 20–34 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ```python def load_openclaw_env(): """加载OpenClaw的.env配置文件""" env_paths = [ Path.home() / ".openclaw" / "workspace" / ".env", Path.home() / ".openclaw" / ".env", ] for env_path in env_paths: if env_path.exists(): with open(env_path, 'r', encoding='utf-8') as f: for line in f: line = line.strip() if line and not line.startswith('#') and '=' in line: key, value = line.split('=', 1) os.environ.setdefault(key, value) ``` ### Technical Analysis The Skill requires only `JIUWU_MESSAGE_GATEWAY_URL`, but `load_openclaw_env()` reads every key-value pair from two shared OpenClaw `.env` files and inserts all of them into the process environment. These configuration files may contain unrelated API keys, authentication tokens, database credentials, or service secrets. Loading every entry violates least privilege because the declared message-sending functionality does not require access to unrelated configuration values. No direct secret transmission or intentional credential theft was identified. However, once loaded, the additional secrets become accessible to any other code running in the same Python process. This is particularly relevant when `send_message` is imported as a library, as documented by the Skill, rather than run in a dedicated process. ### Attack Path 1. The OpenClaw `.env` files contain both the gateway URL and unrelated sensitive credentials. 2. The Skill is imported into a process that also contains compromised, untrusted, or vulnerable Python code. 3. A call to `send_message()` invokes `get_gateway_url()`, which invokes `load_openclaw_env()`. 4. The loader reads ...[truncated 894 chars]
- Remediation
- ## Remediation Suggestions - Prefer requiring `JIUWU_MESSAGE_GATEWAY_URL` to be supplied directly through the existing process environment. - If `.env` fallback behavior is necessary, parse and return only the value of `JIUWU_MESSAGE_GATEWAY_URL`. - Do not copy unrelated values into `os.environ`. - Apply restrictive filesystem permissions to any `.env` file containing credentials. - Consider using a dedicated configuration file containing only this Skill's non-secret gateway setting. - Document the exact configuration value read by the Skill and avoid implying that broad access to shared secret stores is required. A safer implementation would inspect lines only until it finds the exact `JIUWU_MESSAGE_GATEWAY_URL` key and return that value without mutating the process environment.