T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/relay-client.js:43- Finding
Unauthenticated Relay Messages Can Invoke the Local OpenClaw Agent
- Content
View full analysis
{ console.log(`[voice-bridge] User said: "${text}"`); relay.sendTyping(true); try { const response = await bridge.sendMessage(sessionId, text); console.log(`[voice-bridge] Agent response: "${response}"`); relay.sendMessage(response); relay.sendTyping(false); } catch (err) { console.error(`[voice-bridge] Error sending to agent:`, err.message); relay.sendMessage('Sorry, I encountered an error processing your message.'); relay.sendTyping(false); } }); ``` ### Technical Analysis The relay client records the session ID received in a `relay:paired` message, but an incoming `relay:message` is not checked against that recorded value. The code also does not require pairing to have completed before forwarding a message. Consequently, any `relay:message` supplied by the connected relay is treated as an authorized user request. Its attacker-controlled `sessionId` and `text` values are passed to `AgentBridge.sendMessage`, which invokes: ```text openclaw agent --session-id -m ``` The use of `execFile` prevents direct shell metacharacter injection, but it does not address the authorization flaw. The prompt still reaches the local OpenClaw agent and ...[truncated 1678 chars]- Remediation
View remediation