Summary
A server-side request forgery vulnerability in OpenClaw's remote Chrome DevTools Protocol gateway allows DNS rebinding to bypass hostname-based address restrictions. If an attacker controls an approved CDP hostname or its DNS responses, the Gateway may connect to loopback, private, link-local, cloud metadata, or other restricted services.
Affected context
The issue occurs in OpenClaw deployments that use hostname-based remote CDP endpoints with the raw WebSocket or Playwright transport. It becomes possible when validation resolves and approves a hostname separately from the later connection, allowing the DNS answer to change between those operations. Actual exposure depends on the configured endpoint, DNS control, network reachability, and services available from the Gateway host.
Exploit preconditions
- Attack surface: OpenClaw's remote CDP connection functionality
- Required access: Ability to control an approved CDP hostname or influence its DNS answers
- Trigger point: The later WebSocket or Playwright connection after hostname validation
- Why exploitation is possible: Validation and connection perform independent DNS resolutions, creating a check-then-use gap that can redirect the connection to a policy-denied address
Why this happens
The Gateway validates one DNS resolution result and then performs a separate resolution when establishing the actual transport connection. Because the validated address is not securely bound to the address used by the connection, an attacker-controlled DNS response can change between the check and use. This is a time-of-check-to-time-of-use access-control flaw involving network destinations and maps to CWE-918, Server-Side Request Forgery.
Potential impact
- The Gateway may connect to services on loopback or private network interfaces
- Cloud instance metadata or other link-local services could be exposed
- Internal administrative interfaces may receive unintended requests
- Credentials, tokens, or service data may be disclosed
- The attacker could use the Gateway host as a pivot into reachable networks
- Availability or integrity of reachable services could be affected
General mitigation guidance
Mitigation generally focuses on binding destination validation to the exact
address used for connection establishment and reducing trust in
attacker-controlled DNS.
Common defensive patterns include:
- Resolve the hostname once and use the validated address for the connection
- Revalidate every resolved address immediately before use, including redirects or retries
- Apply network egress controls that deny loopback, private, link-local, metadata, and other reserved destinations
- Prefer trusted, stable infrastructure or explicitly allowlisted destination addresses
- Disable hostname-based remote CDP endpoints when they are not required
- Run the Gateway with least-privilege network access and limited service credentials
- Avoid relying on DNS names alone as a security boundary
How teams detect issues like this
Organizations can look for:
- Static analysis and code review findings where DNS validation is separated from socket or WebSocket connection logic
- Network libraries that resolve a hostname independently for validation and transport establishment
- Missing checks for loopback, private, link-local, multicast, and cloud metadata ranges
- Runtime telemetry showing CDP connections to destinations that differ from the validated address
- Egress firewall or proxy alerts for Gateway traffic to internal and metadata endpoints
- Policy checks requiring destination pinning, address revalidation, and restricted outbound network access
Automated security review tools may help identify check-then-use patterns and incomplete SSRF defenses.
