T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-report.sh:65- Finding
Gateway exposure report always misses publicly bound listeners
- Content
View full analysis
/dev/null | grep -c "LISTEN" || true) if echo "$gateway_bind" | grep -q "0.0.0.0"; then result="FAIL" details="Gateway is bound to 0.0.0.0 (exposed to network)" fi ``` ### Technical Analysis The `grep -c "LISTEN"` command discards the actual `lsof` listener records and returns only a numeric count. The subsequent test searches that integer for the string `0.0.0.0`, which can never succeed. As a result, the report generator leaves `result` set to `PASS` even when OpenClaw is listening on all network interfaces. The implementation also does not account for wildcard IPv6 listeners such as `[::]`, which can expose the service beyond loopback. ### Attack Path 1. OpenClaw is intentionally or accidentally configured to listen on `0.0.0.0:18789` or another wildcard address. 2. The user runs `generate-report.sh`. 3. `lsof` finds the publicly accessible listener. 4. `grep -c` replaces the listener details with a numeric value such as `1`. 5. The test for `0.0.0.0` fails. 6. The generated report incorrectly records the network-exposure check as passing. 7. The user may leave the exposed service running based on the false assurance. 8. A remote party able to reach the host can attempt to access or attack the exposed OpenClaw gateway. ### Impact Assessment This flaw does not directly grant additional local privileges. Its security impact is a critical false negative: an internet- or LAN-accessible gateway may remain undetected. Depending on gateway authentication and capabilities, exposure could permit unauthorized interaction with the AI assistant, misuse of connected services, access to data available to the gateway, or consumption of associated API resources. ]]>- Remediation
View remediation
/dev/null || true) if [ -z "$gateway_bind" ]; then result="SKIP" details="Gateway is not listening on port 18789" elif echo "$gateway_bind" | grep -Eq '(\*:18789|0\.0\.0\.0:18789|\[::\]:18789)'; then result="FAIL" details="Gateway is listening on a wildcard network address" elif echo "$gateway_bind" | grep -Eq '(127\.0\.0\.1:18789|\[::1\]:18789)'; then result="PASS" details="Gateway is restricted to loopback" else result="WARN" details="Gateway is listening on a non-loopback interface; manual review required" fi ``` Prefer a structured socket-inspection mechanism where available. Add automated tests covering no listener, IPv4 loopback, IPv6 loopback, IPv4 wildcard, IPv6 wildcard, and a specific non-loopback interface. ]]>