Zevorn RT-Claw Server-Side Request Forgery Vulnerability in HTTP Request Tool

A server-side request forgery (SSRF) vulnerability has been identified in Zevorn RT-Claw versions through 0.2.0. The issue arises in the 'http_request' tool, specifically within the 'claw/tools/tool_net.c' file. The vulnerability allows remote attackers to manipulate the 'url' argument, leading to unauthorized HTTP requests being sent to internal or private network addresses. This could expose sensitive information from loopback or private services.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can access internal HTTP services from the device's context, potentially leading to unauthorized data exposure.

Reproduction

The vulnerability can be reproduced by sending a tool call through the assistant's input channels, such as Telegram or Feishu, with a crafted URL that targets a private network or loopback address. The 'http_request' tool will forward the request without any validation, and the response will be returned to the conversation, allowing the attacker to access internal HTTP endpoint data.