OpenClaw sandbox CDP source range restriction bypass fix

### Vulnerability Overview This vulnerability involves a CDP (Chrome DevTools Protocol) source range restriction issue in the `sandbox` module of the OpenClaw project. By default, the CDP source range is not properly restricted, which may lead to security risks. ### Impact Scope - **Affected Module**: `sandbox` module - **Specific Impact**: Improper restriction of the CDP source range may lead to unauthorized access or data leakage. ### Remediation 1. **Enable CDP Source Range Restriction by Default**: - In `scripts/sandbox-browser-entrypoint.sh`, set `CDP_SOURCE_RANGE` to `127.0.0.1/32` by default. - If `CDP_SOURCE_RANGE` is not set, the socat relay startup will be rejected. 2. **Auto-Derive CDP Source Range**: - Automatically derive the CDP source range from the Docker network gateway IP. - If derivation fails, the socat relay startup will be rejected. 3. **Code Modifications**: - Add test cases in `src/agents/sandbox/browser.create.test.ts` to ensure the CDP source range restriction is correctly applied. - Implement the logic for auto-deriving and restricting the CDP source range in `src/agents/sandbox/browser.ts`. - Update default configurations in `src/agents/sandbox/constants.ts` to ensure the CDP source range restriction takes effect. ### POC Code ```typescript // src/agents/sandbox/browser.create.test.ts it("auto-derives CDP source range from Docker network gateway", async () => { dockerMocks.readDockerNetworkGateway.mockResolvedValue("172.21.0.1"); await expect( ensureSandboxBrowser({ scopeKey: "session:test", workspaceDir: "/tmp/workspace", agentWorkspaceDir: "/tmp/workspace", cfg: buildConfig(false), }) ).resolves.toMatchObject({ envEntries: expect.arrayContaining([ "OPENCLAW_BROWSER_CDP_SOURCE_RANGE=172.21.0.1/32", ]), }); }); it("uses explicit cdpSourceRange over auto-derived gateway", async () => { dockerMocks.readDockerNetworkGateway.mockResolvedValue("172.21.0.1"); const cfg = buildConfig(false); cfg.browser.cdpSourceRange = "10.0.0.0/24"; await expect( ensureSandboxBrowser({ scopeKey: "session:test", workspaceDir: "/tmp/workspace", agentWorkspaceDir: "/tmp/workspace", cfg, }) ).resolves.toMatchObject({ envEntries: expect.arrayContaining([ "OPENCLAW_BROWSER_CDP_SOURCE_RANGE=10.0.0.0/24", ]), }); }); it("rejects IPv6-only gateway (relay binds IPv4)", async () => { dockerMocks.readDockerNetworkGateway.mockResolvedValue("fd12::1"); await expect( ensureSandboxBrowser({ scopeKey: "session:test", workspaceDir: "/tmp/workspace", agentWorkspaceDir: "/tmp/workspace", cfg: buildConfig(false), }) ).rejects.toThrow("Cannot derive CDP source range"); }); it("throws when CDP source range cannot be derived", async () => { dockerMocks.readDockerNetworkGateway.mockResolvedValue(null); await expect( ensureSandboxBrowser({ scopeKey: "session:test", workspaceDir: "/tmp/workspace", agentWorkspaceDir: "/tmp/workspace", cfg: buildConfig(false), }) ).rejects.toThrow("Cannot derive CDP source range"); }); it("requires explicit cdpSourceRange for non-bridge network drivers", async () => { dockerMocks.readDockerNetworkDriver.mockResolvedValue("macvlan"); dockerMocks.readDockerNetworkGateway.mockResolvedValue("172.21.0.1"); await expect( ensureSandboxBrowser({ scopeKey: "session:test", workspaceDir: "/tmp/workspace", agentWorkspaceDir: "/tmp/workspace", cfg: buildConfig(false), }) ).rejects.toThrow("Cannot derive CDP source range"); // Gateway helper should not have been called for non-bridge networks. expect(dockerMocks.readDockerNetworkGateway).not.toHaveBeenCalled(); }); it("uses loopback range for networkmode none (no IPAM gateway, no peer risk)", async () => { dockerMocks.readDockerNetworkGateway.mockResolvedValue(null); const cfg = buildConfig(false); cfg.browser.network = "none"; const result = await ensureSandboxBrowser({ scopeKey: "session:test", workspaceDir: "/tmp/workspace", agentWorkspaceDir: "/tmp/workspace", cfg, }); expect(result).toBeDefined(); const createArgs = findDockerArgCall(dockerMocks.execDocker.mock.calls, "create"); const envEntries = collectDockerFlagValues(createArgs ?? [], "-e"); expect(envEntries).toContain("OPENCLAW_BROWSER_CDP_SOURCE_RANGE=127.0.0.1/32"); }); ``` ### Summary This vulnerability is remediated by enabling CDP source range restrictions by default and auto-deriving the CDP source range, ensuring the security of the `sandbox` module. Relevant code modifications and test cases have been added to the project.

Goal Reached Thanks to every supporter — we hit 100%!

OpenClaw sandbox CDP source range restriction bypass fix

More from this source