T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/common.js:7- Finding
Direct Enumeration of Sensitive WhatsApp Credential-State Metadata
- Content
View full analysis
f.startsWith('sender-key-') && f.includes('@g.us') && f.includes(cleanPhone) ); ``` ```javascript const contactsPath = path.join(CREDS_PATH, 'contacts.json'); if (fs.existsSync(contactsPath)) { const contacts = JSON.parse(fs.readFileSync(contactsPath, 'utf8')); ``` ```javascript const files = fs.readdirSync(CREDS_PATH); const found = files.some(f => f.startsWith('sender-key-') && f.includes(groupId) && f.includes(cleanPhone) ); ``` ```javascript const files = fs.readdirSync(CREDS_PATH); for (const file of files) { if (file.startsWith('sender-key-') && file.includes('@g.us')) { const match = file.match(/--(\d+)_/); if (match) { const phone = match[1]; if (!members.has(phone)) { members.set(phone, { phone, groupCount: 0 }); } members.get(phone).groupCount++; } } } ``` ### Technical Analysis The skill directly reads OpenClaw's WhatsApp credential-state directory instead of using a purpose-built, access-controlled interface. It enumerates sender-key filenames and reads `contacts.json` to derive phone numbers, group identifiers, group names, membership relationships, and group participation counts. Although the documented purpose includes finding shared groups and checking membership, the implementation crosses into credential storage and exposes underlying social-graph metadata. In particular, the `all-members` operation ...[truncated 1762 chars]- Remediation
View remediation