Sipeed PicoClaw Authentication Bypass Vulnerability via Same-Host Loopback Proxying

An authentication bypass vulnerability has been identified in Sipeed PicoClaw versions through 0.2.9. The issue arises in the First Run Setup component, specifically within the web/backend/middleware/access_control.go file. The vulnerability allows remote attackers to bypass authentication by manipulating the 'allowed_cidrs' argument, exploiting the application's trust in loopback IPs. This flaw enables unauthorized access to the launcher dashboard's administrative features, particularly during the initial setup phase when no password has been established.

Impact

Exploiting this vulnerability allows for unauthorized access to the PicoClaw launcher dashboard, enabling an attacker to initialize the admin password and subsequently take over administrative functions.

Reproduction

The vulnerability can be reproduced by configuring the PicoClaw launcher to allow connections from a trusted CIDR range while using a same-host proxy to relay requests from an external IP. This can be done by first sending a request directly to the launcher, which will be rejected due to the CIDR restrictions. Then, the same request can be sent through the proxy, bypassing the CIDR checks and successfully reaching the 'POST /api/auth/setup' endpoint, which is normally protected.

Remediation

Users are advised to update to Sipeed PicoClaw version 0.3.1 or later, where this vulnerability has been patched.