T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/enable-perm-tool.js:43
- Finding
- Unrestricted Enablement of Feishu Permission Management Across All Accounts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/enable-perm-tool.js`, lines 43-65 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```js // 启用顶层 tools.perm if (!config.channels.feishu.tools) { config.channels.feishu.tools = {}; } config.channels.feishu.tools.perm = true; console.log('✅ 已启用 channels.feishu.tools.perm'); // 为所有账号启用 perm 工具 const accounts = config.channels.feishu.accounts || {}; const accountNames = Object.keys(accounts); if (accountNames.length === 0) { console.log('⚠️ 未配置飞书账号'); } else { console.log(`📋 找到 ${accountNames.length} 个飞书账号：${accountNames.join(', ')}`); for (const accountName of accountNames) { const account = accounts[accountName]; if (!account.tools) { account.tools = {}; } account.tools.perm = true; ``` ### Technical Analysis The script unconditionally enables the sensitive Feishu permission-management tool at the channel level and for every configured Feishu account. It does not require the user to select an account, define an allowlist, confirm the affected scope, or opt into channel-wide activation. The enabled tool supports listing, adding, and removing collaborators from Feishu resources. Enabling this capability for all accounts violates the principle of least privilege when the legitimate objective is to activate it for only one account. The channel-level setting may also broaden access beyond the explicit per-account configuration, depending on how OpenClaw resolves inherited tool permissions. The script does not itself add or remove collaborators. Exploitation requires a user or Agent that can invoke the newly enabled `feishu_perm` tool and Feishu application credentials possessing the corresponding document-permission scopes. ### Attack Path 1. An administrator has multiple Feishu accounts configured in `~/.openclaw/openclaw.json`. 2. The administrator runs the helper intending to enable permiss ...[truncated 1344 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require an explicit account identifier as a command-line argument and modify only that account: ```bash node scripts/enable-perm-tool.js --account default ``` 2. Do not enable `channels.feishu.tools.perm` globally by default. Require a separate, explicit option such as `--global` for channel-wide activation. 3. Validate that the requested account exists before making changes, and terminate without modifying the configuration if validation fails. 4. Display the exact configuration changes and affected accounts before writing them, then require interactive confirmation unless a deliberate non-interactive flag is supplied. 5. Support an account allowlist for automated deployments so that only approved accounts receive the permission-management capability. 6. Create a restrictive backup of `~/.openclaw/openclaw.json` before modification and write updates atomically to avoid configuration loss. 7. Document that enabling the tool permits collaborator listing, addition, and removal, and advise administrators to grant the underlying Feishu application only the minimum API scopes and resource access required. 8. After activation, verify the effective tool permissions separately for each account rather than checking only whether the tool was registered globally. ]]>