T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- references/cron-setup.md:31
- Finding
- Recurring Scheduled Task Runs with Unnecessary Highest Privileges<![CDATA[ ## Vulnerability Details **File Location**: `references/cron-setup.md:31-41`; related instructions in `README-定时任务配置.md:33-52` and `SKILL.md:52-62` **Vulnerability Type**: Privileged scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```powershell # Create task schtasks /Create /TN "每日金融课件推送" /TR "python.exe C:\Users\wwwir\.openclaw\workspace\skills\wework-financial-daily\scripts\generate_and_send.py" /SC DAILY /ST 09:00 /RL HIGHEST /F # Query task schtasks /Query /TN "每日金融课件推送" # Delete task schtasks /Delete /TN "每日金融课件推送" /F ``` The graphical setup instructions additionally tell the user to: ```text Run whether the user is logged on or not Run with highest privileges ``` ### Technical Analysis A daily scheduled task is consistent with the Skill's declared automatic-reporting functionality. However, the task is explicitly configured with `/RL HIGHEST`, and the documentation repeatedly directs the user to create it as an administrator. Generating an HTML report, writing it to the user's desktop, uploading it, and making outbound HTTP requests do not inherently require administrator rights. The highest-privilege configuration therefore violates least-privilege principles. The risk is amplified because the scheduled action invokes `python.exe` and a script under a user workspace path. If an unprivileged user or compromised process can replace the script, modify imported modules, influence Python resolution, or change the interpreter found through `PATH`, the scheduled task becomes a recurring elevated-code execution mechanism. Although the persistence is disclosed rather than covert, the privilege level exceeds the minimum necessary for the declared functionality. ### Attack Path 1. The user follows the documentation and creates the task from an administrator session. 2. Windows registers the task to run daily with the highest available privileges. 3. An attacker gains write access to the Skill script, its directory, an impo ...[truncated 890 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `/RL HIGHEST` and create the task under a dedicated, unprivileged account. 2. Do not require administrator execution unless a separately documented operation demonstrably needs it. 3. Configure the task with an absolute, trusted Python interpreter path rather than `python.exe`. 4. Store the Skill in a directory writable only by the task owner and administrators. 5. Use a dedicated virtual environment whose packages and entry points cannot be modified by unrelated users. 6. Restrict the task to the minimum required network and filesystem permissions. 7. Make scheduled-task creation an explicit, opt-in setup step and clearly document how to disable and remove it. 8. Consider using OpenClaw's user-level scheduler instead of an operating-system task with elevated privileges. ]]>