T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server-gemini.js:21- Finding
Unauthenticated Privileged Agent Management API
- Content
View full analysis
{ // Returns registered agents without authentication. }); app.post('/api/agents', async (req, res) => { // Creates persistent agents without authentication. }); app.post('/api/agents/:id/chat', async (req, res) => { // Invokes an OpenClaw agent without authentication. }); app.delete('/api/agents/:id', async (req, res) => { // Deletes an agent without authentication. }); app.listen(PORT, () => { console.log(`🚀 Agent Manager 运行在 http://localhost:${PORT}`); }); ``` ### Technical Analysis The application defines no authentication or authorization middleware for any management endpoint. Consequently, listing, creating, invoking, and deleting agents require no credentials. Calling `app.listen(PORT)` without specifying a host normally binds the Express service to all available interfaces, not exclusively to loopback. In addition, `cors()` with no restrictive configuration permits cross-origin browser requests from arbitrary origins. The affected operations modify files under `~/.openclaw`, invoke the local `openclaw` command, and delete agent directories. These are privileged management actions that should not be exposed as anonymous HTTP operations. ### Attack Path 1. An attacker identifies a host exposing TCP port 3000 or convinces a user to visit an attacker-controlled web page while the service is running. 2. The attacker sends `GET /api/agents` to enumerate registered agents. 3. The attacker sends an unauthenticated `POST /api/agents` request to c ...[truncated 732 chars]- Remediation
View remediation
{ console.log(`Agent Manager listening on http://127.0.0.1:${PORT}`); }); ``` 4. Restrict CORS to an explicit allowlist: ```javascript app.use(cors({ origin: ['http://127.0.0.1:3000'], methods: ['GET', 'POST', 'DELETE'], credentials: true })); ``` 5. Add CSRF protection if cookie-based authentication is used. 6. Add rate limiting, request logging, and audit records for destructive operations. 7. Require confirmation or re-authentication before deletion. 8. Do not return internal filesystem paths or unnecessary agent metadata in error responses. ]]>