Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenClaw privilege escalation vulnerability

nvd.nist.gov

Post reply on HN
Print view View original

301–306 of 306 posts

Re: OpenClaw privilege escalation vulnerability

#301

Post by quietsegfault »

Simon321 wrote: post #15

Only if your openclaw instance is publicly exposed on the internet... which is not the case for most people

It’s possible, and maybe even trivial, to hit a malicious website that tries to connect to the OpenClaw port on your local machine.

A malicious web page runs JavaScript that makes a fetch() or XMLHttpRequest to http://localhost:CLAWPORT — your browser executes that from your machine, so it bypasses your router/firewall entirely. If OpenClaw is listening on localhost with no auth, the browser just connects to it. Same-origin policy doesn’t save you because the request originates from your own machine.

Re: OpenClaw privilege escalation vulnerability

#302

Post by tomhow »

plestik wrote: post #299
tomhow wrote: post #285

Earlier quoted context omitted.

That comment would be a guidelines breach on HN, whether or not it was in reply to the project creator. It gives off just the kind of negativity that HN has always aimed to avoid. Even if we don't always succeed in avoiding it, the guidelines represent an ideal that we work to uphold every day. > Just trying to figure out where the line is It's not really about a line, it's about the qualitative style of discussion w…

For me I think this veers dangerously close to tone policing. I don't think you have to always be extremely civil in the face of what you consider moral bankruptcy. But I can also understand that it creates a vicious cycle so I can appreciate your position here.

Thanks for the discussion and (partially) understanding :)

The use of terms like “moral bankruptcy” is exactly what the guidelines ask us to avoid, indeed explicitly so with the phrase “Assume good faith”.

Part of the challenge of participating on HN is to be able to come into contact with people who see and do things differently (including building software projects in a way that's different from the way we consider proper) and find a way to recognize that they are still acting in good faith and deserving of basic courtesy.

Re: OpenClaw privilege escalation vulnerability

#303

Post by podgorniy »

tgv wrote: post #9
podgorniy wrote: post #3

Earlier quoted context omitted.

[flagged]

Your comment is obviously against the rules, but I read it as: Why are people not more careful? This is some unknown, app, with unknown, unvetted depths, and you only like it because other people say it's shiny and AI. It made you giddy, and you forgot that giving a tool permissions is an invitation to hackers. Well, you went ahead and ignored all common sense, and here we are.

There are many "right" ways to read my comment. Reading it says more about reader than the writer.

And yes, most probably I violated some spoken/unspoken rules and ready to bear consequences.

--

Common sense abotu security has shifted significantly. You're (me including) with out common sense of security are in minority today. We're uncommon. Wait till people start questioning such stance.

--

I just was reading docs on plugin for toddlywiki which makes gives it multiuser support and lan accessibility. The level of awarness of the risks of opening your tw server (i't like 5-ish years ago) to LAN is almost read like a satire from where we're today.

Re: OpenClaw privilege escalation vulnerability

#304

Post by yojimbo117 »

steipete wrote: post #268
tdeck wrote: post #236

Earlier quoted context omitted.

They didn't say the "folks" from those companies were engineers! Maybe it's a group of PMs from Nvidia, ByteDance, Tencent and OpenAI that are working to harden the codebase.

ofc it's software engineers.

[dead]

Re: OpenClaw privilege escalation vulnerability

#305

Post by jamesjansson »

tomhow wrote: post #284
globular-toast wrote: post #272

Earlier quoted context omitted.

I can't really think of a more on topic comment. The thread is about a security issue and the comment is about the quality of the codebase.

The comment is a generic vent about the project’s codebase and development approach, not an effort to engage in curious conversation about this vulnerability. Also, I consider it to be in breach of the guidelines about fulmination, swipes/sneers, and curmudgeonliness.

Isn't the development approach part of the reason that this exploit occurred? The creator openly admitted that they weren't properly reviewing code when describing the project previously. With no engineers who have domain knowledge of the app (because the developers are AI) that leaves a wide gap for exploits to appear.

I feel like just filtering this comment out is a mistake. I use AI, and I think there is a place for it, but if a colleague said "Here's a PR, I didn't even review it" I'd send it back and say "Well you better review it!"

How AI is used is 100% a topic for debate, ranging from "All AI is bad" to "there will be no coding, just vibes". You agree with this right? That there are a range of developers who believe different things all along this spectrum, and that for some developers un-reviewed code is the CAUSE of bad code.

Post reply on HN