Nexting pinclaw Plugin: Auth Bypass on POST /pinclaw/send Allowing Prompt Injection

Vulnerability Overview Vulnerability Title: Nexting pinclaw plugin: POST /pinclaw/send lacks token validation and allows prompt injection into the local operator session Reporter: HaIND (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology, github.com/Haind03 Project: Nexting-ai/nexting, plugin package pinclaw 0.2.0, HTTP router and OpenClaw Gateway bridge Affected Versions: pinclaw 0.2.0 at main (commit: aab75f0429d3bfbf35eef68a296b2e72aa9c7483), identical at release aab9fef9a9385ab833f48bee57fcab60d9adac Vulnerability Types: CWE-862 Missing Authorization, CWE-306 Missing Authentication for Critical Function Status: Source code review Impact Scope Vulnerability Description: The pinclaw plugin runs a local HTTP server. All routes that modify state read the configured and return a 403 error if it does not match, with one exception. reads the request body, checks only for the existence of , and passes it to the agent pipeline without any token validation. The message is sent to the local OpenClaw Gateway as a on session via a connection authenticated as the role, with , , and scopes. Callers with access to the listener can submit prompts to the user's main session without the token required by other routes. The listener starts with without specifying a host, causing Node to bind to all interfaces. The route only returns a request ID, so the caller cannot read the agent's response. Side effects depend on the gateway configuration and have not been tested. Impact: Callers with access to the listener can submit prompts to the local OpenClaw main session without a token, whereas other routes on the same server require one. The session runs with scope, meaning injected prompts are processed by the user's configured agents and tools. Scenarios: - Single-user workstation, port bound only to loopback: Actual impact is limited to local processes. - Shared host or LAN, port accessible via configuration: Unauthorized adjacent callers can inject prompts. The default binding is to all interfaces, with the primary limiting factor being the host firewall. - Browser-driven cross-origin attacks: The route sets wildcard CORS headers, but modern browsers enforce Private Network Access controls, so browser-driven behavior from public pages is not established here. Not Established: HTTP callers cannot read the agent's response (the route only returns a request ID). The injection is blind. Specific actions or data disclosure were not tested. Remote code execution and secret theft depend on the deployment and firewall configuration. This is not a remote code execution vulnerability, nor does it inherently lead to secret theft. Remediation Fix Location: , branch. Short-term Fix: Read and compare the token, identical to sibling routes, before calling . Medium-term Fix: Implement a single authentication step for every HTTP handler, , so new routes cannot operate without checks, avoiding repeated comparisons in each route. Long-term Fix: Bind the listener to by default, explicitly opt-in to state-changing routes, and remove the wildcard . Add regression tests ensuring returns 403 without a valid token. References Route with no token check Sibling route token check Listener bind Gateway RPC chat.send and scopes Node server.listen(port, host) default host CWE-862 Missing Authorization, CWE-306 Missing Authentication for Critical Function No public advisory was identified at the time of writing

Goal Reached Thanks to every supporter — we hit 100%!

Nexting pinclaw Plugin: Auth Bypass on POST /pinclaw/send Allowing Prompt Injection

More from this source