Zevorn RT-Claw Information Disclosure Vulnerability in HTTP Request Tool

An information disclosure vulnerability has been identified in Zevorn RT-Claw versions through 0.2.0. The issue arises in the HTTP request handling functions within the 'claw/services/tools/net.c' file. The vulnerability allows remote attackers to manipulate tool arguments and access local files through the 'file://' URL scheme, which is not properly validated before being sent to libcurl. This flaw could expose sensitive information such as configuration files, logs, API tokens, or other readable files depending on the service account's permissions.

Impact

Exploitation of this vulnerability allows for unauthorized reading of local files, with the contents returned through the AI tool's output, directly accessible to the user.

Reproduction

The vulnerability can be reproduced by influencing the 'http_request' tool's 'url' parameter with a 'file://' URL that points to a local file. This can be done through the AI chat interface, which allows for the manipulation of tool inputs. Once the crafted input is processed, the tool will read the specified file and return its contents in the response, demonstrating the information disclosure flaw.