T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/scan_sessions.py:92- Finding
Excessive Access to OpenClaw Session History
- Content
View full analysis
Vulnerability Details
File Location:
scripts/scan_sessions.py, lines 92-171
Vulnerability Type: Excessive access to private session content beyond the minimum required for usage analysis
Risk Level: MediumVulnerable Code
python def get_session_messages(session_key: str, limit=30): """Fetch messages for a session.""" body, status = gateway_request( f"/sessions/{session_key}/messages?limit={limit}", timeout=8 ) if status == 200 and isinstance(body, list): return body try: result = subprocess.run( ["timeout", "8", "openclaw", "sessions", "history", session_key, "--limit", str(limit), "--json"], capture_output=True, text=True, timeout=10 ) if result.returncode == 0 and result.stdout.strip(): return json.loads(result.stdout) except Exception: pass return [] def extract_skills_from_content(content: str, valid_skills: set) -> list: """Extract skill invocations from message/exec content. Detection patterns (generic — no hardcoded skill names): 1. Skill directory paths: /skills/<name>/ 2. Skill name word-boundary mentions (from registry) """ found = [] content_lower = content.lower() # 1. Skill directory paths: /skills/<name>/ for match in re.finditer(r'/skills/([a-z0-9_-]+)/', content, re.IGNORECASE): skill = match.group(1).lower() if skill not in SKIP_SKILLS and skill in valid_skills: found.append(skill) for skill in valid_skills: if skill in SKIP_SKILLS: continue pattern = rf'\b{re.escape(skill)}\b' if re.search(pattern, content_lower): found.append(skill) seen = set() result = [] for s in found: if s not in seen: seen.add(s) result.append(s) ...[truncated 4117 chars]- Remediation
View remediation
Remediation Suggestions
- Replace conversation scanning with structured execution or audit events containing only the invoked executable, skill identifier, timestamp, and result.
- If structured events are unavailable, restrict collection to messages explicitly identified as execution records rather than ordinary user or assistant content.
- Do not concatenate complete
content,text, ortoolCallsvalues. Extract only narrowly defined command-path fields and discard all other fields immediately. - Require explicit opt-in before session-history scanning and clearly document the data scope, local processing behavior, retention policy, and limitations.
- Reduce default session and message limits and allow users to select which sessions may be inspected.
- Redact credentials, authorization headers, tokens, environment values, and sensitive tool arguments before any processing or logging.
- Ensure usage files and logs are created with user-only permissions and never store raw session content.
- Add tests confirming that ordinary conversation text and unrelated tool arguments are neither processed nor persisted.