T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- server-gemini.js:21
- Finding
- Unauthenticated Privileged Agent Management API<![CDATA[ ## Vulnerability Details **File Location**: `server-gemini.js:21-23, 45-163, 338-340`; equivalent endpoints in `server.js:25-26, 50-297, 1239-1242` **Vulnerability Type**: Missing authentication and authorization, unrestricted CORS, and network-accessible privileged API **Risk Level**: High ### Vulnerable Code ```javascript app.use(cors()); app.use(express.json({ limit: '50mb' })); app.use(express.urlencoded({ extended: true, limit: '50mb' })); app.get('/api/agents', async (req, res) => { // Returns registered agents without authentication. }); app.post('/api/agents', async (req, res) => { // Creates persistent agents without authentication. }); app.post('/api/agents/:id/chat', async (req, res) => { // Invokes an OpenClaw agent without authentication. }); app.delete('/api/agents/:id', async (req, res) => { // Deletes an agent without authentication. }); app.listen(PORT, () => { console.log(`🚀 Agent Manager 运行在 http://localhost:${PORT}`); }); ``` ### Technical Analysis The application defines no authentication or authorization middleware for any management endpoint. Consequently, listing, creating, invoking, and deleting agents require no credentials. Calling `app.listen(PORT)` without specifying a host normally binds the Express service to all available interfaces, not exclusively to loopback. In addition, `cors()` with no restrictive configuration permits cross-origin browser requests from arbitrary origins. The affected operations modify files under `~/.openclaw`, invoke the local `openclaw` command, and delete agent directories. These are privileged management actions that should not be exposed as anonymous HTTP operations. ### Attack Path 1. An attacker identifies a host exposing TCP port 3000 or convinces a user to visit an attacker-controlled web page while the service is running. 2. The attacker sends `GET /api/agents` to enumerate registered agents. 3. The attacker sends an unauthenticated `POST /api/agents` request to c ...[truncated 732 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authentication for every `/api` endpoint. 2. Apply operation-specific authorization so read, chat, create, and delete permissions are separately scoped. 3. Bind explicitly to loopback unless remote access is intentionally required: ```javascript app.listen(PORT, '127.0.0.1', () => { console.log(`Agent Manager listening on http://127.0.0.1:${PORT}`); }); ``` 4. Restrict CORS to an explicit allowlist: ```javascript app.use(cors({ origin: ['http://127.0.0.1:3000'], methods: ['GET', 'POST', 'DELETE'], credentials: true })); ``` 5. Add CSRF protection if cookie-based authentication is used. 6. Add rate limiting, request logging, and audit records for destructive operations. 7. Require confirmation or re-authentication before deletion. 8. Do not return internal filesystem paths or unnecessary agent metadata in error responses. ]]>