T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/email-watch-lite.js:371
- Finding
- OpenClaw Agent Subprocess Inherits Raw Email Credentials## Vulnerability Details **File Location**: `scripts/email-watch-lite.js:371-376` **Related Credential Loading**: `scripts/email-watch-lite.js:6`, `scripts/imap.js:30-33` **Vulnerability Type**: Excessive subprocess privilege and secret exposure **Risk Level**: High ### Vulnerable Code ```js const { checkEmails } = require('./imap'); ``` Importing `scripts/imap.js` executes the following credential-loading code: ```js const EMAIL_ENV_DEFAULT = path.join(os.homedir(), '.openclaw', 'credentials', 'imap-smtp-mail.env'); const EMAIL_ENV_FILE = process.env.EMAIL_ENV_FILE || EMAIL_ENV_DEFAULT; require('dotenv').config({ path: EMAIL_ENV_FILE }); ``` The resulting environment is then passed without filtering to the AI-agent subprocess: ```js const agentOutput = execFileSync(openclawBin, agentArgs, { cwd: WORKSPACE_ROOT, encoding: 'utf8', stdio: 'pipe', env: process.env, timeout: CHILD_PROCESS_TIMEOUT_MS, }); ``` ### Technical Analysis Requiring `./imap` loads the configured dotenv file into the watcher's global `process.env`. This environment can contain `IMAP_PASS`, `SMTP_PASS`, mailbox usernames, server addresses, and unrelated secrets inherited from the parent OpenClaw process. The watcher subsequently starts `openclaw agent` with `env: process.env`, granting the entire subprocess direct access to every loaded credential. The agent needs to process pending email UIDs and can invoke the narrowly scoped mail scripts, but it does not need unrestricted possession of raw IMAP and SMTP passwords. Although `execFileSync` avoids shell command injection, it does not mitigate secret inheritance. Any compromised OpenClaw binary, loaded plugin, agent-accessible local tool, or other code executing in that subprocess can read the credentials directly from its environment. ### Attack Path 1. The watcher imports `scripts/imap.js`. 2. `scripts/imap.js` loads `~/.openclaw/credentials/imap-smtp-mail.e ...[truncated 1042 chars]
- Remediation
- ## Remediation Suggestions - Replace `env: process.env` with an explicit allowlist containing only variables required by the OpenClaw CLI, such as `PATH`, `HOME`, locale settings, and narrowly selected OpenClaw configuration. - Explicitly remove `IMAP_PASS`, `SMTP_PASS`, and other secret-bearing variables before creating the subprocess. - Avoid loading the credential file into the watcher's global environment. Refactor IMAP configuration loading so credentials are held in a local configuration object. - Prefer a narrowly scoped local broker or capability interface that allows the agent to fetch designated UIDs without exposing mailbox credentials. - Run the optional watcher under a dedicated account with minimal filesystem and environment access. - Document the subprocess trust boundary and test that child processes cannot observe email passwords.