T05 · Unauthorized Access and Privilege Escalation
Error
- Location
wallpaper-server.js:18- Finding
Unauthenticated Network-Exposed Bridge Grants Access to the OpenClaw Agent
- Content
View full analysis
{ res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); if (parsedUrl.pathname === '/chat' && req.method === 'POST') { await handleChat(req, res); return; } if (parsedUrl.pathname === '/stream' && req.method === 'POST') { await handleStream(req, res); return; } if (parsedUrl.pathname === '/clear' && req.method === 'POST') { // Request is processed without authentication. } }); server.listen(config.serverPort, config.serverHost, () => { // Server starts on all configured interfaces. }); ``` The bridge subsequently makes privileged Gateway requests: ```javascript const options = { hostname: '127.0.0.1', port: config.gatewayPort, path: '/v1/chat/completions', method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${config.gatewayToken}`, 'x-openclaw-agent-id': config.agentId, 'Connection': 'keep-alive' }, agent: httpAgent }; ``` ### Technical Analysis The bridge listens on `0.0.0.0`, making port 8765 reachable through every available network interface unless an external firewall blocks it. The `/chat`, `/stream`, and `/clear` endpoints do not authenticate callers. ...[truncated 1761 chars]- Remediation
View remediation