Sipeed PicoClaw Improper Access Control Vulnerability in Launcher Component

A vulnerability allowing improper access control has been identified in Sipeed PicoClaw versions through 0.2.9. The issue resides in the Launcher component, specifically within the IPAllowlist function of the access_control.go file. This vulnerability can be exploited remotely, bypassing intended network restrictions and exposing sensitive launcher endpoints.

Impact

Exploitation of this vulnerability can lead to unauthorized access to launcher HTTP endpoints that should have been restricted by CIDR policies. This includes exposure of unauthenticated endpoints such as '/api/auth/status' and '/api/auth/setup', where the first client to reach the endpoint can initialize the dashboard password, potentially allowing further access to the application.

Reproduction

The vulnerability can be reproduced by deploying the PicoClaw launcher behind a reverse proxy on the same host. The IPAllowlist middleware will mistakenly classify remote requests as local, bypassing CIDR restrictions and exposing sensitive endpoints. This can be verified by sending requests through the proxy and observing the response, which will indicate that the access control has been bypassed.

Remediation

Users should update to PicoClaw version 0.3.1, where this vulnerability has been fixed.