T05 · Unauthorized Access and Privilege Escalation
Error
- Location
UnityBridge_Editor.cs:68- Finding
Unauthenticated Local HTTP Control Plane Permits Destructive Unity Operations
- Content
View full analysis
Vulnerability Details
File Location:
UnityBridge_Editor.cs, lines 68-145
Vulnerability Type: Missing authentication and authorization on privileged API endpoints
Risk Level: HighVulnerable Code
csharp private static void RunServer() { try { _listener = new HttpListener(); _listener.Prefixes.Add($"http://localhost:{_port}/"); _listener.Start(); while (_isRunning) { try { var context = _listener.GetContext(); ProcessRequest(context); } catch (HttpListenerException) { break; } } } catch (Exception ex) { Debug.LogError($"[OpenClaw] Server error: {ex.Message}"); } } private static void ProcessRequest(HttpListenerContext context) { var request = context.Request; var response = context.Response; string result = "{}"; int statusCode = 200; try { switch (request.Url.AbsolutePath.ToLower()) { case "/api/ping": result = JsonUtility.ToJson(new { status = "ok", project = GetActiveProjectPath(), unityVersion = Application.unityVersion }); break; case "/api/scene/list": result = ListScenes(); break; case "/api/scene/current": result = GetCurrentSceneInfo(); break; case "/api/scene/open": var scenePath = GetQueryParam(request, "path"); result = OpenScene(scenePath); break; case "/api/gameobject/list": result = ListGameObjects(); break; case "/api/gameobject/create": var objName = GetQueryParam(request, "name") ?? "New GameObject"; result = CreateGameObject(objName); break; case "/api/gameobject/delete": ...[truncated 2941 chars]- Remediation
View remediation
Remediation Suggestions
- Generate a cryptographically random authentication token for each bridge session.
- Require the token in an
Authorization: Bearerheader on every API request. - Store the token only in process memory or another access-controlled location.
- Use POST, PUT, or DELETE for state-changing operations rather than GET.
- Validate the HTTP method for every endpoint.
- Reject browser-originated requests by validating the
Originheader against an explicit allowlist; do not rely on CORS alone. - Add CSRF protection if browser clients are intentionally supported.
- Require explicit Unity Editor confirmation for destructive operations such as deletion, source creation, scene replacement, and builds.
- Consider using an authenticated named pipe or Unix-domain socket instead of a predictable HTTP listener.
- Apply request-size limits, timeouts, rate limits, and audit logging.