T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/export-and-upload.sh:23
- Finding
- Unrestricted Upload of Arbitrary Local Files to External Hosting<![CDATA[ ## Vulnerability Details **File Location**: `scripts/export-and-upload.sh:23-30, 89-101`; related capability documentation at `SKILL.md:10-19` **Vulnerability Type**: Missing source-path authorization and unrestricted external file transfer **Risk Level**: High ### Vulnerable Code ```bash if [ -z "$SOURCE_PATH" ]; then echo "Error: Source path is required" echo "Usage: export-and-upload.sh <source_path> [custom_name]" exit 1 fi if [ ! -e "$SOURCE_PATH" ]; then echo "Error: Source path does not exist: $SOURCE_PATH" exit 1 fi ``` ```bash # Execute upload if [ -n "$USER_ID" ] && [ -n "$AUTH_TOKEN" ]; then echo "Using authenticated upload" RESPONSE=$(curl -s -X POST \ -H "X-User-Id: $USER_ID" \ -H "X-Auth-Token: $AUTH_TOKEN" \ -F "file=@$ARCHIVE_PATH" \ https://tmpfile.link/api/upload) else echo "Using anonymous upload" RESPONSE=$(curl -s -X POST \ -F "file=@$ARCHIVE_PATH" \ https://tmpfile.link/api/upload) fi ``` The documented capability is similarly broad: ```markdown - Share OpenClaw files externally - Create backups of any OpenClaw-related files ``` ### Technical Analysis The script only verifies that the supplied source path exists. It does not canonicalize the path, restrict it to approved OpenClaw directories, reject sensitive files, prevent traversal through symbolic links, or request confirmation after displaying the resolved source and upload destination. Any file or directory readable by the account running the Skill can therefore be compressed and transferred to `tmpfile.link`. If authentication variables are absent, the script automatically falls back to an anonymous upload. The resulting download URL is printed to the caller. Although external export is the Skill's documented purpose, allowing arbitrary readable paths exceeds the least privilege needed to export a specifically approved Skill or configuration. In an agent environment, an unsafe reque ...[truncated 1434 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Canonicalize the source with `realpath` before any operation and reject paths that cannot be resolved safely. 2. Restrict exports to explicit allowlisted roots, such as approved OpenClaw Skill or configuration directories. 3. Verify that the canonical source remains inside an allowed root, including after resolving symbolic links. 4. Deny known-sensitive files and directories by default, including private keys, credential stores, environment files, tokens, browser data, and system authentication material. 5. Require explicit user confirmation immediately before upload. The confirmation should show: - The canonical source path. - Whether the source is a file or directory. - Archive size. - Destination hostname. - Whether the upload is anonymous or authenticated. 6. Avoid automatic anonymous upload of potentially sensitive material. Prefer authenticated and private storage where the service supports it. 7. Consider generating a manifest of archive contents and require approval before transfer. 8. Apply process-level sandboxing so the Skill can read only directories explicitly authorized for export. 9. Clearly warn users that possession of the returned link may grant access to the uploaded content. ]]>