T05 · Unauthorized Access and Privilege Escalation
Error
- Location
clawrent-approve.sh:27- Finding
Expired Rental Processing Deletes the Entire Telegram Allowlist
- Content
View full analysis
"$ALLOW_FILE" } ``` The function is invoked for every expired approval: ```bash echo "Revoking expired lease: ${code:-unknown-code}" if clear_allowlist; then if mark_status "$approval_id" "expired"; then echo "Marked expired: $approval_id" else echo "Failed to mark expired: $approval_id" fi else echo "Failed to clear allowlist for expired lease: $approval_id" fi ``` ### Technical Analysis The declared functionality is to revoke access associated with expired rentals. However, `clear_allowlist` replaces the complete Telegram authorization file with an empty JSON array. It does not identify or remove only the user associated with the expired lease. Although each expired record includes an `id` and potentially a `code`, neither value is used to locate a corresponding entry in the local allowlist. Consequently, the remote expiration status grants broader control over local access than is necessary for the Skill's stated purpose. The credential-related path access is therefore security-sensitive and exceeds least privilege: the script modifies the entire Telegram allowlist when it only needs to revoke one rental. ### Attack Path 1. The Clawrent API returns at least one object in response to the `status=expired` query. 2. `process_expired` accepts the object after checking only that its `id` is nonempty and not `null`. 3. The script calls `clear_allowlist` without confirming that the record maps to an existing, locally tracked rental. 4. `clear_allowlist` overwrites `telegram-allowFrom.json` with `[]`. 5. Every Telegram identity in the allowlist loses access, including identities unrelated to the expired rental. 6. The script reports the remote approval as ...[truncated 784 chars]- Remediation
View remediation