mosaxiv clawlet vulnerabilities

A security flaw in mosaxiv clawlet up to version 0.2.10 affects the list/remove function in tools/tool_cron.go of the cron Chat Tool component. Missing authorization allows remote manipulation. The exploit is public, and the GitHub issue was closed as 'not planned'.

A vulnerability was found in the File Tools component of mosaxiv clawlet up to version 0.2.10, involving symbolic link following in the read_file, write_file, and edit_file functions within tools/fs_ops.go. The attack requires local access.

A server-side request forgery (SSRF) vulnerability was found in the mosaxiv clawlet library up to version 0.2.10 in the tools.webFetch function of tools/tool_web_fetch.go. The attack can be launched remotely, and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability has been identified in the IPv4 Handler component of mosaxiv clawlet up to version 0.2.10. The issue is in the web_fetch function in tools/tool_web_fetch.go, where manipulation of the url argument allows an attacker to send requests to internal resources. The attack can be performed remotely and the exploit has been made public.

A security flaw in mosaxiv clawlet up to version 0.2.10 affects the exec Safety Guard component. The guardExecCommand function in tools/tool_exec.go fails to provide effective protection, allowing remote bypass of security mechanisms. An exploit has been publicly released, and the GitHub issue was closed with the label 'not planned'.