Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenClaw privilege escalation vulnerability

nvd.nist.gov

Post reply on HN
Print view View original

251–260 of 306 posts

Re: OpenClaw privilege escalation vulnerability

#252

Post by steipete »

blks wrote: post #169
steipete wrote: post #55

OpenClaw creator here. This was a privilege-escalation bug, but not "any random Telegram/Discord message can instantly own every OpenClaw instance." The root issue was an incomplete fix. The earlier advisory hardened the gateway RPC path for device approvals by passing the caller's scopes into the core approval check. But the `/pair approve` plugin command path still called the same approval function without `callerS…

> We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI. What exactly does this mean? You have contracts with these companies? People who work for them contributed sometimes in the past to openclaw repository?

They both sponsor the OpenClaw Foundation and provide engineers to improve OpenClaw.

Re: OpenClaw privilege escalation vulnerability

#253

Post by steipete »

nightpool wrote: post #70
steipete wrote: post #55

OpenClaw creator here. This was a privilege-escalation bug, but not "any random Telegram/Discord message can instantly own every OpenClaw instance." The root issue was an incomplete fix. The earlier advisory hardened the gateway RPC path for device approvals by passing the caller's scopes into the core approval check. But the `/pair approve` plugin command path still called the same approval function without `callerS…

Can you speak a little bit more to the stats in the OP? * 135k+ OpenClaw instances are publicly exposed * 63% of those run zero authentication. Meaning the "low privilege required" in the CVE = literally anyone on the internet can request pairing access and start the exploit chain Is this accurate? This is definitely a very different picture then the one you paint

Honestly that seems like total guesswork. There's a lot of FUD going around, or people running portscans and assuming just because they detect a gateway on a port, that they can connect to it. That’s not the case.

Re: OpenClaw privilege escalation vulnerability

#255

Post by maccard »

mattstir wrote: post #247
tao_oat wrote: post #224

Relevant: https://days-since-openclaw-cve.com/ Currently we're at 1.8 CVEs per day since OpenClaw launched!

That is genuinely horrifying. I wonder what the stats are for an average "artisan, hand-typed" project would be if it got as much attention as OpenClaw has. But 1.8 CVEs a day should scare any rational people away from the software... right? Surely?

I’m not an openclaw user or a vibe coder but - the use case of OpenClaw is “give me access to all of your data, programs and information, and I will make decisions and do stuff without asking you permission”. It’s the MO of the project. Even if it was perfectly designed, I think it would have more RCEs by the fact that the Venn diagram of use of the app and high risk areas are a perfect circle

Re: OpenClaw privilege escalation vulnerability

#256

Post by just_once »

gigel82 wrote: post #187
just_once wrote: post #127

Earlier quoted context omitted.

Nvidia, ByteDance, Tencent and OpenAI?! Wow!

Good, hearty group right there. But how about Palantir, NSO Group, Flock and Axon? Aren't they lending a hand too?

Always good to name drop a near universally hated group.

Re: OpenClaw privilege escalation vulnerability

#257

Post by ex-aws-dude »

rolisz wrote: post #213
vasco wrote: post #210

> We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI. But coding is solved? Why do you need those guys if all they do is use claude code? Just have it solve it overnight. You forgot to prompt "make it secure pls"?

Coding is solved, but problems with code is not yet solved.

The Rubik’s cube is solved but the problem with some sides being multiple colors is not solved

Re: OpenClaw privilege escalation vulnerability

#258

Post by shaky-carrousel »

just_once wrote: post #256
gigel82 wrote: post #187

Earlier quoted context omitted.

Good, hearty group right there. But how about Palantir, NSO Group, Flock and Axon? Aren't they lending a hand too?

Always good to name drop a near universally hated group.

Which one? NVIDIA? OpenAI? Bytedance?

Re: OpenClaw privilege escalation vulnerability

#260

Post by nightpool »

stingraycharles wrote: post #202
nightpool wrote: post #70

Earlier quoted context omitted.

Can you speak a little bit more to the stats in the OP? * 135k+ OpenClaw instances are publicly exposed * 63% of those run zero authentication. Meaning the "low privilege required" in the CVE = literally anyone on the internet can request pairing access and start the exploit chain Is this accurate? This is definitely a very different picture then the one you paint

That’s surprising, as the OpenClaw installation makes it pretty difficult to run without auth and explicit device pairing (I don’t even know if that’s possible).

I agree—it looks like the OP didn't provide any sources for these numbers either. That's why I would have hoped that the original maintainer had a better set of metrics to dispute them. It doesn't seem like he does though :(
Post reply on HN