T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- core/openclaw_adapter.py:194
- Finding
- Spawned-agent tool restrictions are declared but not enforced## Vulnerability Details **File Location**: `core/openclaw_adapter.py:194-205` **Additional Location**: `core/four_tuple.py:145-148` **Vulnerability Type**: Failure to enforce least-privilege tool restrictions **Risk Level**: High ### Evidence ```python params = { "task": task, "mode": "run", # 一次性执行 "timeoutSeconds": phi.timeout, } # 模型（使用指定的或默认的） model = phi.model if phi.model != "default" else self.default_model params["model"] = model # 标签 if phi.role: params["label"] = f"{phi.role} [model: {model}]" ``` The alternative parameter builder has the same issue: ```python params = { "task": task, "model": self.model, } ``` ### Technical Analysis `AgentTuple.tools` is presented as an explicit capability subset for a spawned agent. For example, a researcher is assigned only `web_search` and `web_fetch`, while a coder may receive file and command-execution tools. Neither spawn-parameter builder includes this tool allowlist in the request sent to `sessions_spawn`. Consequently, the declared restriction is descriptive rather than enforceable. If the external OpenClaw runtime grants a default set of tools, a child agent may receive capabilities such as file writing or command execution even though its tuple appears to restrict it to web research. This exceeds the minimum privileges required for research and analysis tasks. The issue is compounded by `router/tool_router.py`, where safe mode defaults to disabled. ### Attack Path 1. An attacker supplies a crafted task, or malicious instructions enter the workflow through fetched content. 2. The orchestrator creates an `AgentTuple` that appears to contain a limited tool set. 3. `OpenClawAdapter._build_spawn_params()` omits `phi.tools`. 4. The injected `sessions_spawn` implementation creates the child agent using runtime-default tools. 5. If those defaults include privileged tools, the child agent can be induced to read or modify files, execute commands, or invoke other t ...[truncated 735 chars]
- Remediation
- ## Remediation Suggestions 1. Include an explicit tool allowlist in every spawn request using the exact parameter supported by the OpenClaw runtime. 2. Reject spawning when the runtime cannot guarantee enforcement of the requested tool restrictions. 3. Validate every tool name against a fixed local allowlist before dispatch. 4. Enable safe mode by default and require explicit approval before granting `exec`, `process`, `write`, or `edit`. 5. Define role-specific maximum privileges, such as web-only access for researchers and read-only access for analysts. 6. Ensure an empty tool list means “no tools,” not “use runtime defaults.” 7. Add integration tests that verify a web-only child agent cannot invoke file, process, browser, or messaging tools. 8. Log the effective tool set returned by the runtime and fail closed if it differs from the requested set.