trace_7feb67ede1ff41bab2bf974922f05f52

findercompleted91excellent

StartedApr 13, 2026, 5:46 PM

EndedApr 13, 2026, 5:52 PM

Casecase_d09195f160ac49d49d8ef8f94caf43ec

Modelopenai/gpt-5.4

Context

Blind label

blind_48338341143a

Advisory

GHSA-5hff-46vh-rxmw • OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

Judge score

91 (excellent)

Rubric breakdown

Target Alignment

Source To Sink Reasoning

Impact And Exploitability

Evidence Quality

Overclaim Control

Prompt535 chars

This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Start at src/gateway/session-kill-http.ts and trace POST /sessions/:sessionKey/kill from HTTP authentication through requester/admin routing into killControlledSubagentRun or killSubagentRunAdmin. Show where the vulnerable checkout fails to require the operator scopes later enforced by the fix, and only report session-existence probing if you can ground it in the pre-fix control flow.

OutputJSON

{
  "executiveSummary": "The POST /sessions/:sessionKey/kill gateway endpoint authenticates bearer callers but, in the vulnerable code, does not enforce any HTTP operator/method scopes before dispatching to kill paths. As a result, any identity-bearing bearer caller that can satisfy gateway authentication can terminate subagent sessions via either the local-admin branch or the requester-owned branch, subject only to requester-session ownership checks inside subagent control logic. The handler also performs session lookup before rejecting unauthorized non-owner/non-local requests, enabling session existence probing in the pre-fix control flow.",
  "reports": [
    {
      "title": "Missing HTTP operator-scope enforcement on POST /sessions/:sessionKey/kill allows authenticated low-scope callers to terminate sessions",
      "severity": "HIGH",
      "summary": "The session-kill HTTP handler accepts any request that passes gateway bearer authentication and then routes into killControlledSubagentRun or killSubagentRunAdmin without checking HTTP operator scopes for this method. The only later checks are requester ownership/controlScope in subagent control helpers, which are not substitutes for the missing gateway method-scope authorization boundary. This lets authenticated callers with insufficient scopes reach termination functionality that the fix later restricts to admin scope for direct/admin kill and write scope for requester-owned kill.",
      "rootCauseAnalysis": "In src/gateway/session-kill-http.ts, handleSessionKillHttpRequest calls authorizeGatewayBearerRequestOrReply and only tests the returned boolean. authorizeGatewayBearerRequestOrReply in src/gateway/http-auth-helpers.ts merely authenticates the bearer token through authorizeHttpGatewayConnect and returns true on success; it does not authorize per-method operator scopes. After that, the kill handler immediately loads the target session and then permits either: (1) the admin path whenever isLocalDirectRequest(...) is true, calling killSubagentRunAdmin with no scope check, or (2) the requester-owned path whenever x-openclaw-requester-session-key is present, calling killControlledSubagentRun. killControlledSubagentRun enforces only run ownership and subagent controlScope='children', not HTTP bearer operator scopes. Therefore authenticated HTTP callers are not required to hold the later-enforced operator scopes before invoking kill behavior.",
      "impact": "A bearer-authenticated caller with identity but only read/default/otherwise insufficient operator scopes can kill subagent sessions. For local direct requests, the handler treats loopback access as admin routing and directly invokes killSubagentRunAdmin. For remote requests, a caller can still drive the requester-owned kill path by supplying x-openclaw-requester-session-key, and the downstream helper only checks ownership of the controlled run, not the caller's HTTP operator scopes. This is a denial-of-service against targeted subage

Tool calls

(17)

$sed -n '1,220p' /workspace/src/gateway/session-kill-http.ts

import { createServer } from "node:http";
import type { AddressInfo } from "node:net";
import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";

const TEST_GATEWAY_TOKEN = "test-gateway-token-1234567890";

let cfg: Record<string, unknown> = {};
const authMock = vi.fn(async () => ({ ok: true }) as { ok: boolean; rateLimited?: boolean });
const isLocalDirectRequestMock = vi.fn(() => true);
const loadSessionEntryMock = vi.fn();
const getLatestSubagentRunByChildSessionKeyMock = vi.fn();
const resolveSubagentControllerMock = vi.fn();

$sed -n '1,260p' /workspace/src/gateway/session-kill-http.test.ts

import type { IncomingMessage, ServerResponse } from "node:http";
import {
  killControlledSubagentRun,
  killSubagentRunAdmin,
  resolveSubagentController,
} from "../agents/subagent-control.js";
import { getLatestSubagentRunByChildSessionKey } from "../agents/subagent-registry.js";
import { loadConfig } from "../config/config.js";
import type { AuthRateLimiter } from "./auth-rate-limit.js";
import { isLocalDirectRequest, type ResolvedGatewayAuth } from "./auth.js";
import { authorizeGatewayBearerRequestOrReply } from "./http-auth-helpers.js";
import { sendJson, sendMethodNotAllowed } from "./http-common.js";

sed -n '261,520p' /workspace/src/gateway/session-kill-http.test.ts && printf '\n---\n' && rg -n "authorizeGatewayBearerRequestOrReply|scope|operator|trusted HTTP|method-scope|session-kill" /workspace/src -g '!**/*.map'

exit 124

(no output)

$sed -n '261,520p' /workspace/src/gateway/session-kill-http.test.ts

    expect(resolveSubagentControllerMock).toHaveBeenCalledWith({
      cfg,
      agentSessionKey: "agent:other:main",
    });
    expect(killControlledSubagentRunMock).toHaveBeenCalledWith({
      cfg,
      controller: { controllerSessionKey: "agent:main:main" },
      entry: expect.objectContaining({
        runId: "run-1",
        childSessionKey: "agent:main:subagent:worker",
      }),
    });

rg -n "authorizeGatewayBearerRequestOrReply|scope|operator|trustedHttp|trusted HTTP|method-scope|gateway bearer" /workspace/src/gateway /workspace/src | head -n 200

exit 124

(no output)

$sed -n '1,240p' /workspace/src/gateway/http-auth-helpers.ts

import type { IncomingMessage, ServerResponse } from "node:http";
import type { AuthRateLimiter } from "./auth-rate-limit.js";
import { authorizeHttpGatewayConnect, type ResolvedGatewayAuth } from "./auth.js";
import { sendGatewayAuthFailure } from "./http-common.js";
import { getBearerToken, getHeader, resolveHttpBrowserOriginPolicy } from "./http-utils.js";
import { CLI_DEFAULT_OPERATOR_SCOPES } from "./method-scopes.js";

const OPERATOR_SCOPES_HEADER = "x-openclaw-scopes";

export async function authorizeGatewayBearerRequestOrReply(params: {
  req: IncomingMessage;
  res: ServerResponse;

$sed -n '1,260p' /workspace/src/gateway/auth.ts

import type { IncomingMessage } from "node:http";
import type {
  GatewayAuthConfig,
  GatewayTailscaleMode,
  GatewayTrustedProxyConfig,
} from "../config/config.js";
import { resolveSecretInputRef } from "../config/types.secrets.js";
import { readTailscaleWhoisIdentity, type TailscaleWhoisIdentity } from "../infra/tailscale.js";
import { safeEqualSecret } from "../security/secret-equal.js";
import {
  AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET,
  type AuthRateLimiter,

$sed -n '1,260p' /workspace/src/agents/subagent-control.ts

import crypto from "node:crypto";
import { clearSessionQueues } from "../auto-reply/reply/queue.js";
import {
  resolveSubagentLabel,
  resolveSubagentTargetFromRuns,
  sortSubagentRuns,
  type SubagentTargetResolution,
} from "../auto-reply/reply/subagents-utils.js";
import type { OpenClawConfig } from "../config/config.js";
import type { SessionEntry } from "../config/sessions.js";
import { loadSessionStore, resolveStorePath, updateSessionStore } from "../config/sessions.js";
import { callGateway } from "../gateway/call.js";

rg -n "killControlledSubagentRun|killSubagentRunAdmin|status === \"forbidden\"|controlScope|children|none" /workspace/src/agents/subagent-control.ts | head -n 80 && printf '\n---\n' && sed -n '520,760p' /workspace/src/agents/subagent-control.ts

exit 124

(no output)

rg -n "killControlledSubagentRun|killSubagentRunAdmin|controlScope" /workspace/src/agents/subagent-control.ts | head -n 60

        runId: params.entry.runId,
        sessionKey: params.entry.childSessionKey,
        error: "Steer rate limit exceeded. Wait a moment before sending another steer.",
      };
    }
    steerRateLimit.set(rateKey, now);
  }

  markSubagentRunForSteerRestart(params.entry.runId);

  const targetSession = resolveSessionEntryForKey({
    cfg: params.cfg,

$sed -n '760,980p' /workspace/src/agents/subagent-control.tsexit 124

(no output)

python - <<'PY'
from pathlib import Path
p=Path('/workspace/src/agents/subagent-control.ts').read_text()
for name in ['ensureControllerOwnsRun','killControlledSubagentRun','killSubagentRunAdmin']:
    i=p.find(name)
    print('NAME',name,'IDX',i)
    print(p[i-300:i+1200])
    print('\n---\n')
PY

exit 127

bash: python: command not available in browser environments. Exclude 'python' from your commands or use the Node.js bundle.

node -e "const fs=require('fs'); const p=fs.readFileSync('/workspace/src/agents/subagent-control.ts','utf8'); for (const name of ['ensureControllerOwnsRun','killControlledSubagentRun','killSubagentRunAdmin']) { const i=p.indexOf(name); console.log('NAME',name,'IDX',i); console.log(p.slice(Math.max(0,i-300), Math.min(p.length,i+1600))); console.log('\n---\n'); }"

exit 127

bash: node: command not found

grep -n "killControlledSubagentRun|killSubagentRunAdmin|ensureControllerOwnsRun" /workspace/src/agents/subagent-control.ts | head -n 20

(no output)

awk '/ensureControllerOwnsRun|killControlledSubagentRun|killSubagentRunAdmin/ {print NR ":" $0}' /workspace/src/agents/subagent-control.ts | head -n 40

393:function ensureControllerOwnsRun(params: {
566:export async function killControlledSubagentRun(params: {
571:  const ownershipError = ensureControllerOwnsRun({
642:export async function killSubagentRunAdmin(params: { cfg: OpenClawConfig; sessionKey: string }) {
700:  const ownershipError = ensureControllerOwnsRun({
869:  const ownershipError = ensureControllerOwnsRun({

$sed -n '393,690p' /workspace/src/agents/subagent-control.ts

function ensureControllerOwnsRun(params: {
  controller: ResolvedSubagentController;
  entry: SubagentRunRecord;
}) {
  const owner = params.entry.controllerSessionKey?.trim() || params.entry.requesterSessionKey;
  if (owner === params.controller.controllerSessionKey) {
    return undefined;
  }
  return "Subagents can only control runs spawned from their own session.";
}

async function killSubagentRun(params: {

find /workspace/src -maxdepth 3 \( -name '*scope*' -o -name '*method*' \) -type f | sort | sed -n '1,120p' && printf '\n---\n' && sed -n '1,240p' /workspace/src/gateway/method-scopes.ts

exit 124

(no output)

Step spans

(13)