GoClaw execApproval Safe-Bin Classification Bypass Allows Unapproved File Write/Read

Vulnerability Overview Title: GoClaw execApproval Safe-Bin Classification Bypasses Human Approval for sort -o File Writes and grep -R Recursive Reads #1206 Description: GoClaw exposes an tool for authenticated operators to invoke via POST . When deployed with in combination with , the intended security model is to explicitly mark all safe commands for automatic approval, while high-risk commands require explicit human approval. In the affected versions, the approval manager trusts certain binaries as safe binaries based solely on their base name, classifying and as always safe. Due to the approval logic ignoring option semantics, authorized operators can use to write files and to recursively read workspace contents without generating a pending approval request. Affected Scope Ecosystem: go Package: github.com/nextlevelbuilder/goclaw Affected Versions: < 3.13.2 Fixed Version: 3.13.2 Mitigation Fixed Version: Upgrade to version 3.13.2 or higher. POC Code Log Evidence Impact This is an authorization bypass issue affecting the host command approval layer. It impacts deployments that intentionally rely on to insert a human decision point before dangerous shell operations are executed. Authorized operators can bypass the product's hardcoded safe binaries by selecting base names and adding options that introduce file system read/write behavior. Actual Impact Write or overwrite files in the allowed workspace without a pending approval dialog using . Recursively read workspace contents and disclose matched file data without approval using . Bypass the operator review workflow that administrators expect to protect the product. Affected Products Ecosystem: go Package: github.com/nextlevelbuilder/goclaw Affected Versions: < 3.13.2 Fixed Version: 3.13.2 Severity Severity: Medium Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Weakness CWE: CWE-285: Improper Authorization Occurrence Permalink: goclawInternalHTTPTools_invoke.go goclawInternalToolsExec_approval.go: goclawInternalToolsExec_approval.go goclawInternalToolsShell.go: goclawInternalToolsShell.go Comments mrgoonie: 1 month ago - Summary: I re-reviewed these against surrounding exec approval reports. The safe binary semantic bypass is valid and should remain so because it is distinct, not folded into the shell-chain allowlist-only issue. Confirmation: The accepted security bug #evidence-n #1205 covers shell-chain execution bypass via allowlist parsing; this issue is a different approval classification problem where base-name-only safe binaries are trusted even when options allow read/write behavior. The reported examples map to different risk semantics: sort becomes file write, grep becomes recursive workspace disclosure. Unlike -R, these are not equivalent to narrow stdin/read-only helper scripts. The current issue body contains end-to-end evidence via POST /v1/tools/invoke plus WebSocket approval monitoring: the control touch command creates a pending approval, while sort -o and grep -R complete without pending approval. This also explains why duplicates like #1214 were closed, as they address the same root cause. Keep #1205 as the shell-chain allowlist issue. Fix by making safe binaries parameter aware/flag-closed: either remove grep/sort from unconditional safe binaries, or allow only explicit read-only forms (e.g., no grep recursive/path traversal flags and no sort output write flags). Add regression tests proving that sort -o and grep -R return ask/deny under full + ask-on-miss, while truly safe read-only forms remain auto-allowed if that behavior is intended. mrgoonie: 1 month ago - Added labels: area:security, P1-high, status:needs-triage mrgoonie: 1 month ago - Mentioned in 2 issues: 1 month ago - [Security] GoClaw exec allowlist shell-chain bypass allows execution of non-allowlisted commands #1205 - [Security] GoClaw exec approval allowlist always trusts shell wrappers and lets later -h -c payloads bypass re-approval #1204 mrgoonie: 1 month ago - Added labels: agent:github-maint, maintainer-triage clark-cant: 3 weeks ago - Removed label: status:needs-triage Summary The vulnerability involves the GoClaw tool, which allows authorized operators to bypass the human approval mechanism by exploiting the option semantics of and commands. The mitigation is to upgrade to version 3.13.2 or higher.

Goal Reached Thanks to every supporter — we hit 100%!

GoClaw execApproval Safe-Bin Classification Bypass Allows Unapproved File Write/Read

More from this source