Nextlevelbuilder GoClaw Improper Authorization Vulnerability in Exec Tool

A vulnerability allowing improper authorization has been identified in Nextlevelbuilder GoClaw versions up to 3.13.3-beta.3. The issue arises in the ExecTool.Execute function within the file goclaw/internal/tools/credentialed_exec.go. This vulnerability can be exploited remotely by authenticated users with operator-level roles, allowing them to execute registered high-risk command-line interfaces (CLIs) without the necessary permissions. The bypass is achieved by wrapping commands in PowerShell encoded-command syntax, evading the application's authorization checks.

Impact

Exploitation of this vulnerability allows authenticated users to execute high-risk host binaries that are registered as secure CLIs, bypassing the required authorization grants. This could lead to unauthorized access or actions within the application, depending on the permissions associated with the executed CLI.

Reproduction

To reproduce this vulnerability, an authenticated user with operator-level access can invoke the 'exec' tool through the application's direct tool invocation endpoint. By wrapping a command intended for execution in PowerShell's 'EncodedCommand' format, the secure-CLI authorization checks can be bypassed. This can be automated with a Python script that sends the crafted command to the application, exploiting the vulnerability without detection.

Remediation

Users are advised to update to the latest version of GoClaw, where this vulnerability has been addressed.