T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/mctl.sh:225
- Finding
- Unrestricted Systemd Unit Selection Enables Unauthorized Log Access and Service Restart Attempts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mctl.sh:225-248` **Vulnerability Type**: Missing authorization and allowlist validation for systemd unit names **Risk Level**: Medium ### Vulnerable Code ```bash show_logs() { local name="${EXTRA_ARG:-openclaw-daemon}" if systemctl is-active "$name" >/dev/null 2>&1 || systemctl is-failed "$name" >/dev/null 2>&1; then journalctl -u "$name" --no-pager -n 50 --since "1 hour ago" 2>/dev/null || \ echo "No journalctl logs for $name" else # Try openclaw logs if command -v openclaw >/dev/null 2>&1; then openclaw logs --tail 50 2>/dev/null || echo "No logs found for $name" else echo "Service '$name' not found and openclaw CLI not available" fi fi } do_restart() { local name="${EXTRA_ARG:-}" if [ -z "$name" ]; then echo "Usage: mctl restart <service-name>" exit 1 fi echo -e "${YELLOW}Restarting $name...${RESET}" sudo systemctl restart "$name" 2>/dev/null && \ echo -e "${GREEN}Restarted $name${RESET}" || \ echo -e "${RED}Failed to restart $name${RESET}" } ``` ### Technical Analysis The `logs` and `restart` commands accept an arbitrary value from `EXTRA_ARG` and forward it to `systemctl`, `journalctl`, or `sudo systemctl` without restricting the value to services within the skill's stated OpenClaw scope. Shell metacharacter injection is mitigated because `"$name"` is quoted. However, quoting does not provide authorization: any valid systemd unit name remains selectable. Consequently, the skill may inspect unrelated service journals or request restarts of security-critical services. The documentation states that restart operations require user confirmation, but the implementation contains no confirmation prompt or explicit confirmation flag. It immediately executes `sudo systemctl restart` after checking only that the argument is nonempty. Actual success remains constrained by the invoking account's journal permissions and sudo poli ...[truncated 1886 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict service names to an explicit allowlist: ```bash validate_service() { case "$1" in openclaw-daemon|openclaw-gateway) return 0 ;; *) printf 'Unsupported service: %s\n' "$1" >&2 return 1 ;; esac } ``` 2. Call the validator before every `systemctl` and `journalctl` operation: ```bash validate_service "$name" || exit 1 ``` 3. Reject option-like arguments beginning with `-`, even when commands currently quote the argument: ```bash [[ "$name" != -* ]] || { echo "Invalid service name" >&2 exit 1 } ``` 4. Require explicit confirmation before restart. For interactive use, read an exact confirmation response from a terminal. For automation, require a deliberate flag such as: ```bash mctl restart --confirm openclaw-daemon ``` 5. Avoid invoking unrestricted `sudo`. Configure a narrowly scoped sudoers rule permitting only the exact required actions and unit names. 6. Where feasible, run the monitoring commands under a dedicated low-privilege account with access only to OpenClaw service information. ]]>