{"id":"GHSA-vffc-f7r7-rx2w","summary":"OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)","details":"### Summary\nA command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path.\nWhen rendering `Environment=` entries, attacker-controlled values are not rejected for CR/LF, and `systemdEscapeArg()` uses an incorrect whitespace-matching regex. This allows newline injection to break out of an `Environment=` line and inject standalone systemd directives (for example, `ExecStartPre=`). On service restart, the injected command is executed, resulting in local arbitrary command execution (local RCE) under the gateway service user.\n\n---\n\n### Details\nThe issue is in `src/daemon/systemd-unit.ts`:\n\n- `renderEnvLines(...)` builds:\n- `Environment=${systemdEscapeArg(`${key}=${value}`)}`\n- No CR/LF validation is enforced for environment keys/values before writing unit lines.\n- `systemdEscapeArg(...)` uses:\n- `/[\\\\s\"\\\\\\\\]/`\n- In this regex, `\\\\s` is interpreted as a literal backslash + `s`, not a whitespace character class.\nAs a result, whitespace detection/quoting behavior is incorrect.\nBecause systemd parses unit files line-by-line, a newline inside an environment value can inject an additional directive line. Example rendered output:\n\n```ini\nEnvironment=INJECT=ok\nExecStartPre=/bin/touch /tmp/oc15789_rce\n```\n\nAt restart time, systemd executes `ExecStartPre`, enabling command execution.\n\nRelevant code path/components involved in exploitation chain:\n- `src/daemon/systemd-unit.ts`\n- `src/commands/daemon-install-helpers.ts`\n- `src/config/env-vars.ts`\n- `src/config/zod-schema.ts`\n\nTrigger conditions:\n1. Attacker can influence `config.env.vars` (directly or indirectly).\n2. Install/reinstall path is invoked to write/update the unit.\n3. Service restart occurs (`systemctl --user restart ...`).\n\n---\n\n### PoC\nEnvironment: Linux host with systemd user services enabled.\n\n1. Configure a malicious environment value in OpenClaw config (`config.env.vars`), including a newline and injected directive:\n- Key: `INJECT`\n- Value:\n```text\nok\nExecStartPre=/bin/touch /tmp/oc15789_rce\n```\n\n2. Install/reinstall the gateway service (fixed port as requested):\n```bash\nopenclaw gateway install --port 15789 --force\n```\n\n3. Inspect the generated user unit file (default path):\n```bash\n~/.config/systemd/user/openclaw-gateway.service\n```\nVerify that an injected standalone line exists:\n```ini\nExecStartPre=/bin/touch /tmp/oc15789_rce\n```\n\n4. Reload and restart user service:\n```bash\nsystemctl --user daemon-reload\n```\n```bash\nsystemctl --user restart openclaw-gateway.service\n```\n\n5. Confirm command execution side effect:\n```bash\nls -l /tmp/oc15789_rce\n```\n---\n\n### Impact\nThis is a local command execution vulnerability in OpenClaw’s systemd unit generation during install/reinstall flows.\n\n- **Type:** Command injection via newline/directive injection in unit file generation.\n- **Execution context:** Runs with the same privileges as the OpenClaw gateway service user.\n- **Affected users:** Linux deployments using systemd user services where an attacker can control `config.env.vars` and trigger install/reinstall.\n\n## Fix Commit(s)\n- `61f646c41fb43cd87ed48f9125b4718a30d38e84`","aliases":["CVE-2026-32063"],"modified":"2026-07-08T08:14:43.689247312Z","published":"2026-03-03T21:52:54Z","database_specific":{"nvd_published_at":"2026-03-11T14:16:28Z","cwe_ids":["CWE-77"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-03-03T21:52:54Z"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vffc-f7r7-rx2w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32063"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/61f646c41fb43cd87ed48f9125b4718a30d38e84"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/openclaw-command-injection-via-newline-in-systemd-unit-generation"}],"affected":[{"package":{"name":"openclaw","ecosystem":"npm","purl":"pkg:npm/openclaw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.21"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vffc-f7r7-rx2w/GHSA-vffc-f7r7-rx2w.json","last_known_affected_version_range":"\u003c= 2026.2.19-2"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}