T05 · Unauthorized Access and Privilege Escalation
Error
- Location
assets/agent-kanban/server.js:65- Finding
Unauthenticated Network Exposure of Sensitive Agent Data
- Content
View full analysis
{ res.header('Access-Control-Allow-Origin', '*'); res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.header('Access-Control-Allow-Headers', 'Content-Type'); if (req.method === 'OPTIONS') return res.sendStatus(200); next(); }); ``` ```javascript // assets/agent-kanban/server.js:228-259 app.get('/api/sessions', async (req, res) => { try { const result = await gatewayInvoke('sessions_list', {}); const data = parseSessionsList(result); for (const s of data.sessions) { s.jsonlSizeKB = getAgentJsonlSize(s.agentId); } res.json(data); } catch (err) { console.error('Failed to get sessions:', err); res.status(500).json({ error: err.message }); } }); app.get('/api/sessions/:key/history', async (req, res) => { try { const sessionKey = decodeURIComponent(req.params.key); const result = await gatewayInvoke('sessions_history', { sessionKey, limit: 100 }); const data = parseSessionHistory(result); res.json(data); } catch (err) { console.error('Failed to get session history:', err); res.status(500).json({ error: err.message }); } }); ``` ```javascript // assets/agent-kanban/server.js:262-289 app.get('/api/agents/:agentId/files', async (req, res) => { try { const agentId = decodeURIComponent(req.params.agentId); const workspaceDir = path.join(OPENCLAW_HOME, `workspace-${agentId}`); const files = {}; const fileNames = ['OKR.md', 'SOUL.md', 'HEARTBEAT.md']; for (const fileName of fileNames) { ...[truncated 2878 chars]- Remediation
View remediation