T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/upload-server.js:24- Finding
Password-only configurations leave all file-management APIs unauthenticated
- Content
View full analysis
/dev/null | head -1 | cut -d'"' -f4) # Try to read password if no token is available GATEWAY_PASSWORD=$(grep -o '"password": *"[^"]*"' "${CONFIG_FILE}" 2>/dev/null | head -1 | cut -d'"' -f4) # Check authentication mode AUTH_MODE=$(grep -o '"mode": *"[^"]*"' "${CONFIG_FILE}" 2>/dev/null | head -1 | cut -d'"' -f4) if [ -n "${GATEWAY_TOKEN}" ]; then echo "✅ Authentication mode: Token" echo "✅ Gateway Token found" AUTH_VALUE="${GATEWAY_TOKEN}" elif [ -n "${GATEWAY_PASSWORD}" ]; then echo "✅ Authentication mode: Password" echo "✅ Gateway Password found" AUTH_VALUE="${GATEWAY_PASSWORD}" ``` `install.sh:79`: ```sh Environment=GATEWAY_AUTH_VALUE=${AUTH_VALUE} ``` `src/upload-server.js:24-36`: ```js function loadGatewayToken() { try { const configPath = path.join(process.env.HOME || '/home/admin', '.openclaw/openclaw.json'); const config = JSON.parse(fs.readFileSync(configPath, 'utf8')); return config.gateway?.auth?.token || ''; } catch (e) { return ''; } } const GATEWAY_TOKEN = loadGatewayToken(); ``` Representative authorization check in `src/upload-server.js:333-335`: ```js const tokenParam = parsedUrl.searchParams.get('token'); if (GATEWAY_TOKEN && tokenParam !== GATEWAY_TOKEN) { ``` `src/upload-server.js:493`: ```js server.listen(PORT, '0.0.0.0', () => { ``` ### Technical Analysis The installer claims to support both Gateway tokens and passwords. It stores either value in the `GATEWAY_AUTH_VALUE` ...[truncated 1907 chars]- Remediation
View remediation