T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- skill.yaml:61
- Finding
- Unauthenticated webhook permits unrestricted browser navigation and SSRF<![CDATA[ ## Vulnerability Details **File Location**: `skill.yaml:5-9`, `skill.yaml:20-31`, and `skill.yaml:61-68` **Vulnerability Type**: Unauthenticated SSRF through attacker-controlled browser navigation **Risk Level**: High ### Vulnerable Code ```yaml trigger: type: "webhook" path: "/api/audit/scan" method: "POST" ``` ```yaml ui: runnable: true input_schema: type: "object" properties: url: type: "string" format: "uri" description: "Target URL to audit (must be HTTP/HTTPS)" include_har: type: "boolean" default: true required: - "url" ``` ```yaml - step: "navigate-and-wait" action: "builtin.navigate" depends_on: - "launch-browser" config: url: "{{ .input.url }}" wait_until: "networkidle0" timeout: "{{ .input.timeout | default 15000 }}" ``` ### Technical Analysis The POST webhook accepts a caller-controlled URI and passes it directly to the browser navigation action. No webhook authentication, authorization, hostname allowlist, protocol enforcement, address-range validation, redirect validation, or DNS-rebinding defense is defined. Although the input description says the target must use HTTP or HTTPS, the schema only specifies the generic `uri` format. More importantly, even restricting the initial URL to HTTP or HTTPS would not prevent access to loopback, private, link-local, or cloud metadata addresses. Because the browser operates from the OpenClaw host's network context, the endpoint can act as a server-side request forgery primitive. Redirects and DNS changes must also be checked, because validation of only the initial textual hostname would be insufficient. ### Attack Path 1. An attacker sends a POST request to `/api/audit/scan`. 2. The request supplies a URL resolving to a loopback, private-network, link-local, cloud metadata, or otherwise internal destination. 3. The skill passes the URL directly to `builtin.navigate`. 4. The browser requests ...[truncated 726 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require strong authentication and authorization for the webhook. - Restrict accepted schemes explicitly to `http` and `https`. - Resolve the hostname before navigation and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. - Repeat destination validation after every redirect and connection resolution. - Protect against DNS rebinding by binding validation to the addresses actually used for each connection. - Use an explicit destination allowlist where operationally possible. - Place the browser in a network-isolated environment with deny-by-default egress rules. - Apply request rate limits, concurrency limits, and audit logging. - Avoid exposing captured content to the caller unless separately authorized. ]]>