Picoclaw
Monthly
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauthorized actions by sending crafted group messages through the `handleMessageReceive` function in `pkg/channels/feishu/feishu_64.go`. All versions up to and including 0.2.9 are affected. A publicly available proof-of-concept exploit exists via GitHub issue #3082, but the issue was closed automatically due to inactivity - indicating no vendor-supplied fix has been released. No public exploit identified at time of analysis as actively exploited in the wild.
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the server to issue outbound HTTP requests to the RFC 2544 benchmark address range (198.18.0.0/15), which was omitted from the private/restricted IP blocklist in the `isPrivateOrRestrictedIP` function. The CVSS 4.0 score of 2.1 reflects the narrow impact scope and authentication requirement (PR:L). A publicly available proof-of-concept exists via GitHub issue #3077, and an upstream patch has been committed but no tagged release version has been independently confirmed as shipping the fix.
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass access controls and perform unauthorized actions on affected deployments running version 0.2.9 and earlier. The flaw resides in the dispatchIncoming function within pkg/channels/wecom/wecom.go, where incoming group messages are processed without properly verifying the caller's authorization level. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates exploitation remains opportunistic rather than widespread at time of analysis.
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a local low-privileged attacker to manipulate the NewContextBuilder function in pkg/agent/context.go, causing the application to load or execute functionality outside its intended control boundary. The impact is limited - partial confidentiality, integrity, and availability effects - but a publicly available proof-of-concept exploit exists. Critically, the vendor closed the disclosure issue on GitHub as 'not planned,' meaning no official patch will be released, leaving users without a vendor-supported remediation path.
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the server issue HTTP requests to private or internal network resources by bypassing the application's SSRF guard. The incomplete protection in `pkg/utils/http_guard.go` fails to detect ISATAP IPv6 addresses that encode private IPv4 addresses in their lower 32 bits, enabling bypass via crafted URLs such as `http://[2001:db8::5efe:127.0.0.1]`. A public exploit exists and a patch is available upstream, though no CISA KEV listing is recorded at time of analysis.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attackers to replay previously captured webhook requests against the ParseRequest function, injecting fraudulent LINE messaging events without possessing the channel secret. All versions through 0.2.9 are affected. A public exploit exists, and the vendor closed the GitHub disclosure as 'not planned,' confirming no official patch will be issued.
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privilege users to exploit the ExecTool.executeRun function in the Go-based pipeline execution agent, achieving limited confidentiality, integrity, and availability impacts. A publicly available proof-of-concept exists via GitHub issue #3081, though the vendor closed the report as 'not planned,' signaling no intent to patch. No public exploit identified at time of analysis in CISA KEV; the local-only attack vector and low impact ceiling make this a low-priority finding for most environments.
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin password setup request against an uninitialized instance. The vulnerable handler at `/api/auth/setup` in `web/backend/api/auth.go` accepted POST requests without validating `Origin`, `Referer`, or `Sec-Fetch-Site` headers, enabling a malicious webpage to silently register attacker-controlled credentials on a victim's locally-running PicoClaw instance. A publicly disclosed exploit exists (GitHub issue #3072); no active exploitation is confirmed in CISA KEV.
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.ReloadConfig function in pkg/channels/pico/pico.go by manipulating the message.send argument without proper authorization checks. The integrity and availability of the affected system are both at limited risk, as the CVSS 4.0 vector confirms no confidentiality exposure but allows unauthorized configuration reload or disruption. A public exploit exists (E:P), though the GitHub issue tracking the report was closed automatically due to inactivity, indicating no vendor remediation has been issued.
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP allowlist enforced by the Launcher's web backend middleware. The flaw resides in the IPAllowlist function within web/backend/middleware/access_control.go, which fails to correctly enforce source-address restrictions, permitting unauthorized network access to protected endpoints. A public proof-of-concept exploit exists (GitHub issue #3069), and an upstream patch (PR #3126) has been submitted but a formally released patched version has not been independently confirmed.
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allows remote low-privileged attackers to bypass access controls by manipulating the `client_id` argument, enabling unauthorized access to MQTT channels belonging to other clients. A public proof-of-concept exploit exists via the referenced GitHub issue, elevating practical risk beyond the moderate CVSS 4.0 score of 5.3. No vendor patch has been released - the upstream GitHub issue was closed automatically due to inactivity - leaving affected deployments without an official remediation path.
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchTool.Execute function within the Guarded Web Fetch Flow component, causing the server to issue arbitrary outbound requests on behalf of the attacker. The vulnerability carries a CVSS 4.0 base score of 2.1, reflecting limited confidentiality, integrity, and availability impact with no subsequent-system scope change. A public exploit has been released (E:P confirmed), but no vendor patch exists - the upstream GitHub issue was closed automatically due to inactivity, not resolution.
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attackers to execute arbitrary system commands via the /api/gateway/restart endpoint. CVSS 7.3 (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation without authentication. Proof-of-concept code exists (CVSS:E:P). Vendor has not responded to responsible disclosure (reported via GitHub issue #2307), indicating no official patch is available. The Web Launcher Management Plane component suggests this affects administrative/control interfaces, making it a high-priority target for internet-exposed deployments.
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauthorized actions by sending crafted group messages through the `handleMessageReceive` function in `pkg/channels/feishu/feishu_64.go`. All versions up to and including 0.2.9 are affected. A publicly available proof-of-concept exploit exists via GitHub issue #3082, but the issue was closed automatically due to inactivity - indicating no vendor-supplied fix has been released. No public exploit identified at time of analysis as actively exploited in the wild.
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the server to issue outbound HTTP requests to the RFC 2544 benchmark address range (198.18.0.0/15), which was omitted from the private/restricted IP blocklist in the `isPrivateOrRestrictedIP` function. The CVSS 4.0 score of 2.1 reflects the narrow impact scope and authentication requirement (PR:L). A publicly available proof-of-concept exists via GitHub issue #3077, and an upstream patch has been committed but no tagged release version has been independently confirmed as shipping the fix.
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass access controls and perform unauthorized actions on affected deployments running version 0.2.9 and earlier. The flaw resides in the dispatchIncoming function within pkg/channels/wecom/wecom.go, where incoming group messages are processed without properly verifying the caller's authorization level. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates exploitation remains opportunistic rather than widespread at time of analysis.
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a local low-privileged attacker to manipulate the NewContextBuilder function in pkg/agent/context.go, causing the application to load or execute functionality outside its intended control boundary. The impact is limited - partial confidentiality, integrity, and availability effects - but a publicly available proof-of-concept exploit exists. Critically, the vendor closed the disclosure issue on GitHub as 'not planned,' meaning no official patch will be released, leaving users without a vendor-supported remediation path.
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the server issue HTTP requests to private or internal network resources by bypassing the application's SSRF guard. The incomplete protection in `pkg/utils/http_guard.go` fails to detect ISATAP IPv6 addresses that encode private IPv4 addresses in their lower 32 bits, enabling bypass via crafted URLs such as `http://[2001:db8::5efe:127.0.0.1]`. A public exploit exists and a patch is available upstream, though no CISA KEV listing is recorded at time of analysis.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attackers to replay previously captured webhook requests against the ParseRequest function, injecting fraudulent LINE messaging events without possessing the channel secret. All versions through 0.2.9 are affected. A public exploit exists, and the vendor closed the GitHub disclosure as 'not planned,' confirming no official patch will be issued.
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privilege users to exploit the ExecTool.executeRun function in the Go-based pipeline execution agent, achieving limited confidentiality, integrity, and availability impacts. A publicly available proof-of-concept exists via GitHub issue #3081, though the vendor closed the report as 'not planned,' signaling no intent to patch. No public exploit identified at time of analysis in CISA KEV; the local-only attack vector and low impact ceiling make this a low-priority finding for most environments.
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin password setup request against an uninitialized instance. The vulnerable handler at `/api/auth/setup` in `web/backend/api/auth.go` accepted POST requests without validating `Origin`, `Referer`, or `Sec-Fetch-Site` headers, enabling a malicious webpage to silently register attacker-controlled credentials on a victim's locally-running PicoClaw instance. A publicly disclosed exploit exists (GitHub issue #3072); no active exploitation is confirmed in CISA KEV.
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.ReloadConfig function in pkg/channels/pico/pico.go by manipulating the message.send argument without proper authorization checks. The integrity and availability of the affected system are both at limited risk, as the CVSS 4.0 vector confirms no confidentiality exposure but allows unauthorized configuration reload or disruption. A public exploit exists (E:P), though the GitHub issue tracking the report was closed automatically due to inactivity, indicating no vendor remediation has been issued.
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP allowlist enforced by the Launcher's web backend middleware. The flaw resides in the IPAllowlist function within web/backend/middleware/access_control.go, which fails to correctly enforce source-address restrictions, permitting unauthorized network access to protected endpoints. A public proof-of-concept exploit exists (GitHub issue #3069), and an upstream patch (PR #3126) has been submitted but a formally released patched version has not been independently confirmed.
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allows remote low-privileged attackers to bypass access controls by manipulating the `client_id` argument, enabling unauthorized access to MQTT channels belonging to other clients. A public proof-of-concept exploit exists via the referenced GitHub issue, elevating practical risk beyond the moderate CVSS 4.0 score of 5.3. No vendor patch has been released - the upstream GitHub issue was closed automatically due to inactivity - leaving affected deployments without an official remediation path.
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchTool.Execute function within the Guarded Web Fetch Flow component, causing the server to issue arbitrary outbound requests on behalf of the attacker. The vulnerability carries a CVSS 4.0 base score of 2.1, reflecting limited confidentiality, integrity, and availability impact with no subsequent-system scope change. A public exploit has been released (E:P confirmed), but no vendor patch exists - the upstream GitHub issue was closed automatically due to inactivity, not resolution.
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attackers to execute arbitrary system commands via the /api/gateway/restart endpoint. CVSS 7.3 (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation without authentication. Proof-of-concept code exists (CVSS:E:P). Vendor has not responded to responsible disclosure (reported via GitHub issue #2307), indicating no official patch is available. The Web Launcher Management Plane component suggests this affects administrative/control interfaces, making it a high-priority target for internet-exposed deployments.