T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/start-win11-browser-cdp-for-openclaw.ps1:117
- Finding
- Unauthenticated CDP Relay Binds to All Windows Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `scripts/start-win11-browser-cdp-for-openclaw.ps1:59-65, 117-145` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```powershell function Get-WslCidr { $addr = Get-NetIPAddress -AddressFamily IPv4 -ErrorAction Stop | Where-Object { ($_.InterfaceAlias -like '*WSL*' -or $_.InterfaceAlias -like '*vEthernet*') -and (Test-PrivateIPv4 $_.IPAddress) } | Sort-Object -Property InterfaceAlias | Select-Object -First 1 if (-not $addr) { throw 'Could not find WSL/Hyper-V IPv4 interface address.' } $prefix = [int]$addr.PrefixLength $ipNum = Get-IPv4UInt32 $addr.IPAddress $mask = if ($prefix -eq 0) { [uint32]0 } else { [uint32]([uint32]::MaxValue -shl (32 - $prefix)) } $network = $ipNum -band $mask $networkIp = ConvertTo-IPv4String $network return [pscustomobject]@{ InterfaceAlias = $addr.InterfaceAlias IPAddress = $addr.IPAddress PrefixLength = $prefix Cidr = "$networkIp/$prefix" } } function Ensure-PortProxy { Write-Log "Ensuring portproxy 0.0.0.0:$RelayPort -> 127.0.0.1:$CdpPort" netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=$RelayPort 2>$null | Out-Null netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=$RelayPort connectaddress=127.0.0.1 connectport=$CdpPort | Out-Null if (!(Test-HttpOk "http://127.0.0.1:$RelayPort/json/version")) { throw "Local portproxy test failed on 127.0.0.1:$RelayPort" } Write-Log "Portproxy responding locally on 127.0.0.1:$RelayPort" } function Ensure-Firewall([string]$RemoteCidr) { if (-not $RemoteCidr -or $RemoteCidr -eq '0.0.0.0/0') { throw 'Refusing to create broad firewall rule for browser CDP relay.' } Write-Log "Ensuring firewall rule '$FirewallRuleName' for remote $RemoteCidr -> TCP $RelayPort" Get-NetFirewallRule -DisplayName $OldFirewallRuleName -ErrorAction SilentlyContinue | ...[truncated 3183 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind the portproxy to the exact WSL-facing Windows IPv4 address rather than `0.0.0.0`. 2. Identify the intended WSL adapter explicitly instead of accepting every alias containing `vEthernet` and selecting the first match. 3. Verify that the selected adapter is associated with the active WSL environment and expected gateway route. 4. Reject unexpectedly broad network prefixes and require the derived CIDR to fall within an explicitly approved range. 5. Scope the firewall rule to the exact WSL source address when feasible, rather than the entire virtual subnet. 6. Restrict the firewall rule to the specific local address and appropriate network profile in addition to the remote CIDR. 7. After setup, verify the effective listening addresses with `Get-NetTCPConnection` or `netstat` and inspect the effective firewall address filters. 8. Abort and roll back the portproxy if firewall creation or post-creation validation fails. 9. Continue using a dedicated browser profile by default and require explicit approval before exposing a personal or authenticated profile. 10. Consider an authenticated local proxy or another authenticated transport if CDP must cross a network boundary. ]]>