GoClaw vulnerabilities

In GoClaw up to version 3.13.2, the function ExecTool.Execute in file goclaw/internal/http/tools_invoke.go, component jq Handler, is vulnerable to information disclosure via manipulation. The attack can be launched remotely. Exploit has been published. The patch is called 1230.

A vulnerability has been found in GoClaw up to version 3.13.3-beta.3 in the ExecTool.Execute function of the goclaw/internal/tools/credentialed_exec.go file. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.

A security vulnerability was found in GoClaw up to version 3.15.0-beta.32, allowing SSRF attacks via the CheckSSRF/isPrivateIP function in internal/tools/web_shared.go. The attack can be launched remotely and the exploit has been publicly disclosed.

In GoClaw up to version 3.13.2, the function ToolsInvokeHandler.ServeHTTP in file internal/http/tools_invoke.go lacks authorization. The attack can be performed remotely, and the exploit is publicly available.

A security flaw in GoClaw up to version 3.13.2 affects the extractBin/RequestApproval/matchesAllowlist function in internal/tools/exec_approval.go, causing incorrect authorization. A public exploit is available, enabling attacks.

A vulnerability was found in GoClaw up to version 3.13.2 in the isSafeBin function of the file internal/tools/exec_approval.go. The issue leads to improper authorization, allowing remote attacks. The exploit is publicly available and may be used.

A vulnerability was found in GoClaw up to version 3.13.3-beta.3 in the matchesAllowlist/extractBin functions of internal/tools/exec_approval.go. Input manipulation can lead to incorrectly-resolved names, enabling remote attacks. The exploit has been publicly disclosed and may be used.

A vulnerability in the WebSocket Approval Endpoint component of GoClaw up to version 3.13.2 involves incorrect authorization in the RequestApproval function. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 in the handleNavigate function of the pkg/browser/tool.go file. Manipulation of the args.targetUrl argument leads to information disclosure. The attack can be performed remotely and the exploit is publicly available.

A path traversal vulnerability was found in GoClaw 3.13.3-beta.3 by nextlevelbuilder in the writeFile function of internal/providers/acp/tool_bridge.go within the ACP ToolBridge Workspace Handler component. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A vulnerability was found in GoClaw 3.11.3 in the ExecApprovalManager.CheckCommand function in internal/tools/exec_approval.go. Manipulation results in an incomplete blacklist, allowing remote attack execution. The exploit has been made public and could be used.

A vulnerability was found in GoClaw 3.13.3-beta.3 in the bytePlusDownloadVideo function of internal/tools/create_video_byteplus.go. Manipulation of the output.video_url argument leads to server-side request forgery (SSRF). Remote exploitation is possible and the exploit has been publicly disclosed.

A security vulnerability has been detected in GoClaw up to version 3.13.0-beta.2, affecting the MethodRouter.Handle function in the internal/gateway/router.go file of the WebSocket RPC Handler component. The flaw leads to incorrect authorization, potentially allowing unauthorized access.

A vulnerability in GoClaw (nextlevelbuilder) up to version 3.11.3 in the resolveAuth function of internal/http/auth.go leads to missing authentication. Remote exploitation is possible and the exploit is publicly disclosed.

A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/team_tasks_lifecycle.go of the component Team Task Completion Handler. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. The Import function in internal/http/tts_config.go of the TTS Configuration Endpoint component leads to server-side request forgery. The exploit has been disclosed publicly.

A vulnerability in GoClaw up to version 3.11.3, in the FsBridge.WriteFile function of internal/sandbox/fsbridge.go, allows remote OS command injection via the write_file tool.

A vulnerability was found in nextlevelbuilder GoClaw up to version 3.11.3 in the auth function of file internal/http/evolution_handlers.go, leading to improper authorization. The attack can be executed remotely, and the exploit has been disclosed publicly. The project tagged the issue as a bug.

Vulnerability in GoClaw (nextlevelbuilder) up to version 3.11.3 allows improper privilege management through manipulation in the handleSave function of the file internal/http/tts_config.go. Affects the RoleAdmin Gateway component.