T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server/index.ts:215- Finding
Unauthenticated privileged management API exposed on all network interfaces
- Content
View full analysis
{ console.log('[UPDATE] OpenClaw update triggered'); try { const result = runUpdate(); res.json(result); } catch { res.status(500).json({ error: 'Update failed' }); } }); app.post('/api/restart/:id', (req, res) => { const { id } = req.params; const gatewayId = id === 'earl' ? 'earl-gateway' : id === 'solara' ? 'solara-gateway' : null; if (!gatewayId) { res.status(400).json({ error: 'Unknown gateway. Use earl or solara.' }); return; } console.log(`[RESTART] Gateway restart triggered: ${id}`); const result = restartService(gatewayId); if (result.success) { res.json({ ok: true, message: `${id} gateway restarting` }); } else { res.status(500).json({ error: result.error }); } }); app.post('/api/services/:id/:action', (req, res) => { const { id, action } = req.params; if (action !== 'start' && action !== 'stop') { res.status(400).json({ error: 'Invalid action. Use start or stop.' }); return; } const result = controlService(id, action); if (result.success) { res.json({ ok: true }); } else { res.status(500).json({ error: result.error }); } }); app.post('/api/spawn', async (req, res) => { const { agent, task } = req.body; try { const session = await spawner.spawn(agent, task); res.json({ ok: true, id: session.id, agent: session.agent, sessionKey: session.sessionKey, }); } catch (err) { const status = (err as Error).message.includes('Max concurrent') ? 429 : 400; res.status(status).json({ ok: false, error: (err as Error).message }); } }); server.listen(SERVER_PORT, '0.0.0.0', () => { console.log(`\n🎮 Pixel Agents Dashboard running at http://lo ...[truncated 2591 chars]- Remediation
View remediation