T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/OpenClawGameBridge.js:34- Finding
Unauthenticated WebSocket Control Plane Permits Client Impersonation and Game Control
- Content
View full analysis
{ for (const [playerUid, clientWs] of this.clients) { if (clientWs.readyState === WebSocket.OPEN) { // 发送ping保持连接 clientWs.ping(); } } }, 30000); // 每30秒发送一次ping this.wss.on('connection', (ws) => { console.log('[Bridge] 新客户端连接'); ws.isAlive = true; ws.on('pong', () => { ws.isAlive = true; }); ws.on('message', (data) => { try { const msg = JSON.parse(data); console.log('[Bridge] 收到消息:', msg.type, JSON.stringify(msg).substring(0, 200)); this.handleMessage(msg, ws); } catch (error) { console.error('[Bridge] 消息解析错误:', error); } }); ``` The command relay accepts a player identifier supplied by the requesting client: ```javascript onBridgeSendCommand(ws, msg) { const playerUid = msg.playerUid; const command = msg.command; if (!playerUid || !command) { console.log(`[Bridge] sendCommand 缺少参数: playerUid=${playerUid}, command=`, command); return; } const targetWs = this.clients.get(playerUid); if (!targetWs || targetWs.readyState !== WebSocket.OPEN) { console.log(`[Bridge] sendCommand 玩家不在线: ${playerUid}`); return; } // 包装成 ai_control 消息发给游戏客户端 targetWs.send(JSON.stringify({ type: 'ai_control', playerUid: playerUid, command: command })); con ...[truncated 3325 chars]- Remediation
View remediation