T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- clawrent-approve.sh:27
- Finding
- Expired Rental Processing Deletes the Entire Telegram Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `clawrent-approve.sh:27-30, 70-76` **Vulnerability Type**: Improper authorization revocation and excessive privilege **Risk Level**: High ### Vulnerable Code ```bash clear_allowlist() { mkdir -p "$(dirname "$ALLOW_FILE")" echo "[]" > "$ALLOW_FILE" } ``` The function is invoked for every expired approval: ```bash echo "Revoking expired lease: ${code:-unknown-code}" if clear_allowlist; then if mark_status "$approval_id" "expired"; then echo "Marked expired: $approval_id" else echo "Failed to mark expired: $approval_id" fi else echo "Failed to clear allowlist for expired lease: $approval_id" fi ``` ### Technical Analysis The declared functionality is to revoke access associated with expired rentals. However, `clear_allowlist` replaces the complete Telegram authorization file with an empty JSON array. It does not identify or remove only the user associated with the expired lease. Although each expired record includes an `id` and potentially a `code`, neither value is used to locate a corresponding entry in the local allowlist. Consequently, the remote expiration status grants broader control over local access than is necessary for the Skill's stated purpose. The credential-related path access is therefore security-sensitive and exceeds least privilege: the script modifies the entire Telegram allowlist when it only needs to revoke one rental. ### Attack Path 1. The Clawrent API returns at least one object in response to the `status=expired` query. 2. `process_expired` accepts the object after checking only that its `id` is nonempty and not `null`. 3. The script calls `clear_allowlist` without confirming that the record maps to an existing, locally tracked rental. 4. `clear_allowlist` overwrites `telegram-allowFrom.json` with `[]`. 5. Every Telegram identity in the allowlist loses access, including identities unrelated to the expired rental. 6. The script reports the remote approval as ...[truncated 784 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Associate every approved rental with a specific, stable Telegram identity rather than relying only on a pairing code or remote approval ID. - Parse the current allowlist and remove only the entry associated with the expired rental. - Verify that the remote expiration record maps to a locally tracked and currently active lease before changing local access-control state. - Preserve unrelated allowlist entries. - Write the updated JSON to a temporary file with restrictive permissions, validate it with `jq`, and atomically rename it over the original file. - Avoid creating a missing credential directory or allowlist automatically during revocation unless that behavior is explicitly required. - Preserve the original file and refrain from reporting the remote status as expired if targeted local revocation cannot be completed safely. - Consider maintaining a separate ledger of identities added by this Skill so it cannot revoke identities managed by administrators or other integrations. ]]>