T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/app/api/agents/activity/route.ts:43- Finding
Unauthenticated Disclosure of OpenClaw Session and Cron Messages
- Content
View full analysis
15 && entry.content.length < 200) { const text = entry.content.replace(/\n/g, ' ').substring(0, 120); if (text.startsWith('[') || text.startsWith('Read ') || text.startsWith('HEARTBEAT')) continue; activities.push({ timestamp: entry.timestamp || file.mtime.toISOString(), agentId: agent.id, agentName: agent.name, agentEmoji: agent.emoji, agentColor: agent.color, message: text, type: classifyMessage(text), }); } } catch { continue; } } ``` ```ts if (fs.existsSync(cronRunsDir)) { const cronFiles = fs.readdirSync(cronRunsDir) .filter(f => f.endsWith('.jsonl')) .map(f => ({ name: f, mtime: fs.statSync(path.join(cronRunsDir, f)).mtime })) .sort((a, b) => b.mtime.getTime() - a.mtime.getTime()) .slice(0, 10); for (const file of cronFiles) { try { const content = fs.readFileSync(path.join(cronRunsDir, file.name), 'utf-8'); const lines = content.trim().split('\n').slice(0, 5); for (const line of lines) { try { const entry = JSON.parse(line); if (entry.role === 'user' && typeof entry.content === 'string') { const text = entry.content.replace(/\n/g, ' ').substring(0, 120); activities.push({ timestamp: file.mtime.toISOString(), agentId: 'cron', agentName: 'Cron', agentEmoji: '⏰', ag ...[truncated 2583 chars]- Remediation
View remediation