T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/shared/authorization.ts:196- Finding
Default-Open Authorization Exposes Administrative WeChat Tools to Public User Agents
- Content
View full analysis
| undefined; const section = (channels?.[CONFIG_SECTION_KEY] as { dynamicAgents?: { permissionMode?: string } } | undefined) ?? (channels?.[LEGACY_CONFIG_SECTION_KEY] as | { dynamicAgents?: { permissionMode?: string } } | undefined); const mode = section?.dynamicAgents?.permissionMode; if (mode === "admin-only") return "admin-only"; if (mode === "role-based") return "role-based"; return "open"; } ``` `src/shared/authorization.ts:254-257`: ```ts export function checkAuthorization(ctx: AuthorizationContext): AuthorizationDecision { const mode = getPermissionMode(ctx.cfg); if (mode === "open") { return { allowed: true }; } ``` `src/tools/shared.ts:123-148`: ```ts export function assertAuthorized(params: { ctx: ToolContext; apiConfig?: OpenClawConfig; toolName: string; action: string; accountId: string; }): ToolResult | null { const cfg = params.ctx.runtimeConfig ?? params.ctx.config ?? params.apiConfig; if (!cfg) return null; // Missing configuration is allowed rather than denied const decision = checkAuthorization({ cfg, toolContext: { agentId: params.ctx.agentId, requesterSenderId: params.ctx.requesterSenderId, senderIsOwner: params.ctx.senderIsOwner, }, accountId: params.accountId, toolName: params.toolName, action: params.action, }); if (decision.allowed) return null; return buildErrorResult({ action: params.action, error: decision.reason, permissionMode: "adm ...[truncated 4252 chars]- Remediation
View remediation