Information Disclosure in GoClaw via Malicious URL Handling

Executive Summary

CVE-2026-15627 is an authenticated information disclosure vulnerability in nextlevelbuilder GoClaw versions up to and including 3.13.3-beta.3.

The vulnerability occurs in the function handleNavigate within the file pkg/browser/tool.go. It involves insufficient input validation of the args.targetUrl argument, which allows an attacker to manipulate the URL to disclose sensitive information.

Specifically, an authenticated user with operator or higher privileges can navigate a controlled browser tab to a file:// URL. This enables the user to read local file contents through normal page readback primitives like snapshot and act.evaluate. The vulnerability stems from the lack of a scheme allowlist, allowing malicious file:// URLs to be passed directly to Rod's page.Navigate(url) function without proper validation.

A proof-of-concept exploit has been demonstrated, confirming that an attacker can navigate to a local file and retrieve its contents via the authenticated API.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can look for signs of exploitation or misconfigured instances of GoClaw (versions <= 3.13.3-beta.3). The vulnerability allows authenticated users to disclose local files via `file://` URLs through the browser tool's navigation feature.

• Check for unusual API requests to the `/v1/tools/invoke` endpoint, particularly those containing `file://` URLs in the `args.targetUrl` parameter. This can be done by reviewing logs for the GoClaw service or network traffic to the endpoint.
• Inspect the GoClaw logs for any direct invocations of the `handleNavigate` function in `pkg/browser/tool.go` with suspicious URLs. Look for entries where `targetUrl` starts with `file://`.
• Verify the installed version of GoClaw. If it is version 3.13.3-beta.3 or earlier, the system is vulnerable. You can check the version by running the GoClaw binary with the `--version` flag or reviewing the deployment configuration.
• Monitor for unexpected file read operations from the GoClaw process. Tools like `auditd` on Linux or Process Monitor on Windows can be used to track file access by the GoClaw process.

Example command to check the GoClaw version (if installed as a binary):

• ./goclaw --version

Example command to monitor file access by the GoClaw process on Linux (requires `auditd`):

• sudo auditctl -w /path/to/goclaw -p r -k goclaw_file_access

Example command to search logs for suspicious `file://` URLs (assuming logs are stored in `/var/log/goclaw.log`):

• grep -i 'file://' /var/log/goclaw.log

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of GoClaw (up to 3.13.3-beta.3):

• Exposure of sensitive local files: An attacker with authenticated access (operator or higher privileges) can read files accessible to the GoClaw browser process user. This may include configuration files, logs, tokens, or workspace files.
• Unauthorized access to confidential data: If the GoClaw process has access to sensitive files (e.g., credentials, personal data, or proprietary information), this data could be disclosed to unauthorized parties.
• Potential for further exploitation: The disclosed information could be used to escalate privileges, move laterally within a network, or launch additional attacks.

The attack can be performed remotely, meaning an attacker does not need physical access to the system to exploit this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have significant implications for compliance with common standards and regulations, depending on the type of data exposed and the context in which GoClaw is used:

• GDPR (General Data Protection Regulation): If the exposed files contain personal data of EU citizens, this vulnerability could lead to a data breach under GDPR. Organizations may face fines, mandatory breach notifications, and reputational damage. GDPR requires that personal data be processed securely, and this vulnerability represents a failure to implement appropriate technical measures to protect such data.
• HIPAA (Health Insurance Portability and Accountability Act): If GoClaw is used in a healthcare context and the exposed files contain protected health information (PHI), this vulnerability could result in a HIPAA violation. HIPAA requires covered entities to implement safeguards to protect PHI, and unauthorized disclosure could lead to penalties and corrective action plans.
• Other regulations: Depending on the industry and jurisdiction, this vulnerability could also impact compliance with standards like PCI DSS (if payment card data is exposed), SOX (if financial data is exposed), or other sector-specific regulations that mandate data protection and access controls.

Organizations using GoClaw should assess whether the vulnerability exposes regulated data and take immediate steps to mitigate the risk, such as applying patches or implementing compensating controls, to avoid potential compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade GoClaw to the latest version if a patch is available. The vulnerability affects versions up to and including 3.13.3-beta.3. Check the project's GitHub repository or release notes for updates.
• If upgrading is not immediately possible, apply the temporary fix suggested in the GitHub issue. This involves modifying the `handleNavigate` function in `pkg/browser/tool.go` to validate the `targetUrl` parameter and block `file://` URLs. Ensure the URL scheme is restricted to allowed values (e.g., `http://`, `https://`).
• Restrict access to the `/v1/tools/invoke` endpoint to trusted users only. Use network-level controls such as firewalls or API gateways to limit access to this endpoint.
• Review and audit user roles and permissions within GoClaw. Ensure that only users with the necessary privileges (e.g., operator or higher) have access to the browser tool's navigation feature.
• Monitor the GoClaw logs for any suspicious activity, such as attempts to access `file://` URLs or unusual file read operations. Set up alerts for such events.
• Isolate the GoClaw instance from sensitive files and directories. Ensure the process runs with the least privileges necessary and cannot access critical system files.
• Consider disabling the browser tool feature if it is not required for your use case. This can be done by removing or commenting out the relevant code paths in the GoClaw configuration or source code.

Useful 0 Not Useful 0