NanoClaw Approval Response Authentication Bypass Vulnerability Fix (CVE-202X-XXXX)

Vulnerability Overview This vulnerability involves a trust boundary issue in NanoClaw's approval response mechanism. A valid is no longer sufficient to resolve a pending privileged approval. The approval response now requires the clicker/responder to be an owner, global administrator, or a member of the approval agent group to execute OneCLI or registered module approval handlers. Impact Issue: The approval response handler trusts a valid prior to authorizing the responder's identity. Impact: Non-administrators can trigger or replay valid approval response payloads to approve or reject privileged actions protected by NanoClaw's approval workflow. Severity: Medium Remediation 1. Load Pending Approvals: Load pending approvals before running any OneCLI parser or registered module approval handler. 2. Normalize Responder ID: Normalize the responder ID to the same namespace identifier format used by the permissions module. 3. Scoped Approvals: Requires . 4. Unscoped Approvals: Requires permissions. 5. Unauthorized Clicks: Return as processed input but keep the pending approval row intact so that legitimate administrators can respond. 6. New Tests: Cover both unauthorized and authorized approval response paths. POC Code Additional Key Information CVSS Assessment: CVSS v3.1 vector is , with a medium severity rating. Security Reproduction Steps: 1. Generate a pending approval for a privileged action (e.g., ). 2. Register an approval handler for this action. 3. Submit an approval response with a valid but as a non-administrator. 4. Prior to this PR, the handler path could be reached based solely on a valid . 5. Post-PR, the response is ignored, the handler is not invoked, and the pending approval remains available to the actual administrator. 6. Submit the same approval as an owner/global administrator and observe successful handler dispatch. Expected Vulnerability Behavior: - A valid should not authorize the clicker. - Pre-patch behavior allowed the approval response path to continue before checking the clicker's role. - The security signal is whether the registered approval handler is invoked for a non-administrator responder. Changes in this PR: - Add to normalize the responder ID before permission checks and handler dispatch. - Add to perform approval resolution before executing owner/global-admin or scoped admin authorization. - Move authorization checks to before OneCLI parsers and module approval handler dispatches. - Keep unauthorized approvals pending instead of deleting them. - Add regression tests: - Non-administrator responses to valid are ignored. - Owner/administrator responses dispatch the registered handler. - Global administrator responses work without a scoped agent group. File Changes: - : Checks the responder role before resolving OneCLI or registered module approvals. - : Covers unauthorized and authorized approval response behaviors. Maintainer Impact: - The patch scope is limited to approval response processing and targeted testing. - Reuses existing owner/global-admin/scoped-admin role semantics rather than introducing separate approval-specific ACLs. - Unauthorized clicks are ignored without consuming the pending approval, reducing the risk of accidental denial-of-service against legitimate administrator approval cards. - Approval handlers now receive normalized responder IDs, matching the identifier format used in the permissions table. Fix Rationale: - The response handler is the persistent server-side boundary for approval decision convergence, making it the correct location to enforce responder authorization. - Reusing , , and keeps the fix consistent with the existing role model. - Keeping pending approvals intact ensures that unauthorized clicks still resolve the request without discarding the approval. - Tests cover actual database-backed pending approval paths, not just private helpers. Change Type: - Security Fix - Testing - Documentation Update - Refactoring with no behavior changes Test Plan: - Targeted approval response regression tests pass. - Full Vitest suite passes. - TypeScript type checking passes. - Prettier formatting check passes. - Whitespace diff check passes. - ESLint is currently not clean due to existing unrelated lint errors outside this patch. Disclosure Notes: - Production systems were not tested. - No real credentials, secrets, or destructive payloads are included. - The attacker model assumes the user can submit or replay valid approval response payloads; no claim of unauthenticated access is made. - Unrelated files were not modified.

Goal Reached Thanks to every supporter — we hit 100%!

NanoClaw Approval Response Authentication Bypass Vulnerability Fix (CVE-202X-XXXX)

More from this source