T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- openclaw-wrapper/execute.sh:113
- Finding
- Conversation Session Selection Is Not Bound to the Invoking User## Vulnerability Details **File Location**: `openclaw-wrapper/execute.sh:113-120`; `src/integrations/openclaw-session-reader.ts:91-96` **Vulnerability Type**: Improper authorization and cross-user session access **Risk Level**: High ### Vulnerable Code `openclaw-wrapper/execute.sh:113-120` ```bash if [ -z "$SESSION_FILE" ]; then # Try to locate session file from OpenClaw directory OPENCLAW_SESSIONS="$HOME/.openclaw/agents/main/sessions" if [ -d "$OPENCLAW_SESSIONS" ]; then # Find most recent .jsonl file SESSION_FILE=$(ls -t "$OPENCLAW_SESSIONS"/*.jsonl 2>/dev/null | head -1) ``` `src/integrations/openclaw-session-reader.ts:91-96` ```ts const sessionKey = `agent:main:${userId}`; let sessionId = sessionsMeta[sessionKey]?.sessionId; if (!sessionId) { // Fallback to default main session sessionId = sessionsMeta['agent:main:main']?.sessionId; } return sessionId || null; ``` ### Technical Analysis The wrapper accepts a user identity independently from the session file but does not verify that the selected session belongs to that user. When no session file is supplied, it selects the most recently modified JSONL file from the entire main-agent session directory. The alternative TypeScript session reader first attempts an exact user lookup but falls back to the global `agent:main:main` session when that lookup fails. This fallback crosses the intended user-to-session authorization boundary. In a shared or multi-user OpenClaw installation, the newest or default session may belong to a different user. The selected conversation is then treated as if it belonged to the invoking user. The session runner extracts up to 120 recent events, including both user and assistant text, and passes the resulting conversation to the personality-analysis pipeline. Path traversal protections on the session ID do not address this issue because the vulnerability concerns authorization and ownership, not path syntax. ### Attack Path 1. Multiple users interact ...[truncated 1391 chars]
- Remediation
- ## Remediation Suggestions 1. Remove selection of the globally newest session file. 2. Remove the `agent:main:main` fallback when a user-specific session cannot be found. 3. Resolve session files only through an authoritative mapping between the authenticated invoking user and session ID. 4. Fail closed when no exact mapping exists or when multiple sessions are ambiguous. 5. Validate that an explicitly supplied session path belongs to the invoking user rather than merely checking that the file exists. 6. Restrict accepted session paths to the canonical OpenClaw session directory after resolving symlinks with `realpath`. 7. Require explicit user confirmation before processing a session selected through any fallback or administrative workflow. 8. Add multi-user tests proving that one user cannot analyze another user's newest, default, or explicitly named session. 9. Do not upload or save derived identity data if session ownership cannot be established.