📙 From Assistant to Assassin: Weaponizing An OpenClaw Vulnerability to Achieve 1-Click RCE 🖥️
summary
OpenClaw contains a configuration-logic flaw that lets a crafted URL set a gateway, trigger client-side auto-login, and exfiltrate the admin authentication token over WebSocket, enabling 1-click RCE by chaining that with a Cross-Site WebSocket Hijacking primitive. The exploit runs two background pages to reach localhost, abuses websockets’ lax SOP, and bypasses four defenses (user approvals, sandboxing, pairing-mode auth, and network boundaries) to run a local payload—the PoC opens a calculator. OpenClaw (recently acquired, with 300,000 GitHub stars) is the case study.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 1:05Security vs productivity balance
- 3:38OpenClaw overview and impact
- 5:06Vulnerability background
- 8:37Chaining benign features
- 12:27Exploit demonstration
- 15:58Bypassing defenses
- 19:31Proof of concept demo
- 21:17Q&A session
related talks
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
55mAttacking Modern Web Technologies
55m2024 Security BSides // John Hammond
30mHow to hack an Angular app?
50mModern WebApp Vulnerabilities
35mInside a hacker’s mind
28mA New Era of One-Click Attacks: How to Break Install-Less Apps
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."