Zevorn RT-Claw Incorrect Authorization Vulnerability in Swarm RPC Handler Allowing Arbitrary Code Execution

An incorrect authorization vulnerability has been identified in Zevorn RT-Claw versions through 0.2.0. The issue resides in the RPC Handler component, specifically within the claw_tool_invoke function of the file claw/services/swarm/swarm.c. This vulnerability allows for unauthorized execution of tools marked as local-only, bypassing intended security restrictions. The flaw can be exploited remotely, leading to unauthorized execution of arbitrary Python code on Linux nodes where the 'run_script' tool is enabled.

Impact

Exploitation of this vulnerability allows for unauthorized invocation of local-only tools over the swarm RPC, leading to arbitrary code execution on the affected Linux node in the context of the RT-Claw process.

Reproduction

To reproduce this vulnerability, first build Zevorn RT-Claw for a Linux environment with the 'swarm' and 'tool_script' options enabled. Once the application is running, a crafted UDP swarm RPC request can be sent to the node's public swarm listener, targeting the 'run_script' tool with attacker-controlled JSON parameters. The request will bypass the local-only restriction and execute the provided Python code on the node.