T09 · Insecure Skill Coding Practices
Error
- Location
- bridge_server.py:151
- Finding
- Unauthenticated Network Endpoint Can Invoke the Main Agent<![CDATA[ ## Vulnerability Details **File Location**: `bridge_server.py:12-13`, `bridge_server.py:151-164`, `bridge_server.py:334-380`, `bridge_server.py:446-447` **Vulnerability Type**: Unauthenticated network-to-agent execution and whitelist bypass **Risk Level**: High ### Vulnerable Code ```python HOST = '0.0.0.0' PORT = 8765 ``` ```python def should_forward_to_openclaw(text: str, source: str) -> tuple[bool, str, str]: normalized = normalize_text(text) if not normalized: return False, 'empty_text', '' matched_subagent = detect_named_subagent(text) if source != 'xiaoai-speaker': return True, 'non_xiaoai_source', matched_subagent has_target = any(target in normalized for target in BRIDGE_WHITELIST_TARGETS) has_verb = any(verb in normalized for verb in BRIDGE_WHITELIST_VERBS) direct_target = any(normalized.startswith(target) for target in BRIDGE_WHITELIST_TARGETS) if has_target and (has_verb or direct_target): return True, 'matched_bridge_whitelist', matched_subagent return False, 'not_in_bridge_whitelist', matched_subagent ``` ```python length = int(self.headers.get('Content-Length', '0')) body = self.rfile.read(length) if length > 0 else b'{}' payload = json.loads(body.decode('utf-8') or '{}') text = str(payload.get('text', '')).strip() source = str(payload.get('source', 'xiaoai-speaker')).strip() or 'xiaoai-speaker' ``` ```python server = HTTPServer((HOST, PORT), Handler) server.serve_forever() ``` ### Technical Analysis The bridge listens on every network interface through `0.0.0.0` but does not require a bearer token, HMAC signature, client certificate, or other authentication. Consequently, any client that can reach TCP port 8765 can submit text to the bridge. The `source` value is also entirely client-controlled. The forwarding function automatically approves every nonempty request where `source` is not exactly `xiaoai-speaker`. This allows a remote client to bypass the XiaoAI whitel ...[truncated 1939 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind to `127.0.0.1` by default and require users to opt in explicitly to LAN exposure. 2. Require a strong shared bearer token, HMAC-signed requests, or mutual TLS. 3. Compare authentication values using a constant-time comparison. 4. Do not trust a client-provided `source` field for authorization decisions. 5. Reject unknown source values and apply the same content policy to every request. 6. Configure a strict allowlist of permitted client IP addresses where appropriate. 7. Add a small maximum request size before reading the body, such as 8–16 KB. 8. Add rate limiting, a bounded worker pool, and per-client quotas. 9. Run the bridge and downstream agent with a dedicated, least-privileged account and restricted tool set. 10. Document firewall requirements and warn against exposing port 8765 to untrusted networks. ]]>