T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- references/playwright-recipes.md:130
- Finding
- Production customer passwords can be destructively overwritten during testing<![CDATA[ ## Vulnerability Details **File Location**: `references/playwright-recipes.md:130-159` **Vulnerability Type**: Production account mutation using unrestricted administrative credentials **Risk Level**: High ### Vulnerable Code ```js const cred = Object.fromEntries( fs.readFileSync(process.env.HOME + '/.openclaw/credentials/supabase/credentials.env', 'utf8') .split('\n').filter(l => l.includes('=')) .map(l => { const i = l.indexOf('='); return [l.slice(0, i), l.slice(i + 1)]; }) ); const USER_ID = '...'; const TEMP_PASS = 'temp-' + Date.now(); await fetch(`${cred.SUPABASE_URL}/auth/v1/admin/users/${USER_ID}`, { method: 'PUT', headers: { apikey: cred.SUPABASE_SERVICE_ROLE_KEY, Authorization: 'Bearer ' + cred.SUPABASE_SERVICE_ROLE_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ password: TEMP_PASS }), }); // ... do test work ... // IMPORTANT: scramble the password back so the test password isn't usable. await fetch(`${cred.SUPABASE_URL}/auth/v1/admin/users/${USER_ID}`, { method: 'PUT', headers: { apikey: cred.SUPABASE_SERVICE_ROLE_KEY, Authorization: 'Bearer ' + cred.SUPABASE_SERVICE_ROLE_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ password: 'reset-' + Math.random().toString(36) }), }); ``` ### Technical Analysis The recipe uses the production Supabase service-role key to replace the password of an arbitrary user identified by `USER_ID`. A service-role key bypasses normal row-level authorization and can administer the entire Supabase project. The purported cleanup does not restore the original password. It changes the password to another unknown value, permanently invalidating the customer's original credentials. In addition, the initial temporary password is based only on the current timestamp and is not cryptographically random. If execution terminates before the second request, that predictable password can remain active. Mutating a real customer's cr ...[truncated 1172 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the password-mutation recipe from production workflows. - Perform portal testing in a separate staging Supabase project with disposable synthetic users. - Use a dedicated, allowlisted test account rather than an arbitrary `USER_ID`. - Prefer single-use magic links or a purpose-built, audited impersonation mechanism that does not alter user credentials. - Never attempt to “restore” a password by replacing it with another unknown value. - Require explicit human approval for every production administrative operation. - If any temporary mutation remains necessary in a non-production environment, use a cryptographically random secret, wrap cleanup in `try/finally`, impose a short expiration, and verify rollback. - Rotate the production service-role key if this recipe has been exposed to untrusted operators or execution environments. ]]>