T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- dashboard_server.py:872
- Finding
- Unauthenticated Administrative API Exposed on All Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `dashboard_server.py:872-875` **Vulnerability Type**: Missing authentication and network access control **Risk Level**: Critical ### Vulnerable Code ```python app.run( host=config.get('host', '0.0.0.0'), port=config.get('port', 5178), debug=config.get('debug', False), threaded=True ) ``` The configured value confirms the unsafe default: ```json { "host": "0.0.0.0", "port": 5181 } ``` Administrative routes are registered without authentication or authorization checks, for example: ```python @app.route('/api/agents/<agent_name>', methods=['DELETE']) def delete_agent_endpoint(agent_name): if not _validate_agent_name(agent_name): abort(400, "Invalid agent name") try: result = openclaw_config_manager.delete_agent(agent_name) return jsonify(result) except Exception as e: return jsonify({"success": False, "error": str(e)}), 500 ``` ### Technical Analysis The Flask application binds to every interface while implementing no login mechanism, bearer-token validation, session authorization, request-signature validation, or authorization middleware. Network access to port 5181 is therefore sufficient to invoke privileged API operations. The exposed API can read OpenClaw session information and system paths, update dashboard and OpenClaw configuration, create or delete agents, modify subagent permissions, enable or disable skills, upload files, and initiate skill installation. This contradicts the documentation statement that authentication is inherited from OpenClaw. The dashboard is a separate Flask application and contains no implementation that performs such inheritance. ### Attack Path 1. An attacker discovers TCP port 5181 on a host running the dashboard. 2. The attacker requests `/api/agents` or `/api/system-info` without credentials to enumerate agents and installation paths. 3. The attacker submits unauthenticated POST or DELETE request ...[truncated 666 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind to `127.0.0.1` by default and require an explicit secure configuration to permit remote access. 2. Add authentication to every `/api/` endpoint. Use a securely generated credential or integrate with OpenClaw through a documented, verified authentication protocol. 3. Enforce authorization by operation. Destructive and installation actions should require an administrator role and explicit reauthentication. 4. Add CSRF protection to state-changing browser requests and reject requests with untrusted `Origin` or `Host` headers. 5. Place remote deployments behind a TLS-enabled reverse proxy and restrict access through firewall rules or a private VPN. 6. Add rate limiting, audit logging, and alerts for agent deletion, configuration changes, prompt changes, and skill installation. 7. Update the documentation so it does not claim inherited authentication unless that integration is actually implemented and tested. ]]>