GitHub Security Advisory: GHSA-6fpf-248c-m7wm
Package: github.com/bishopfox/sliver (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
Vulnerable versions: <= 1.7.3
Patched in: 1.7.4

Summary: Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

Details:
A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, `ntds.dit`) or destroying the entire compromised infrastructure, entirely through the operator's own browser.

## Description
The Sliver MCP server runs inside the Sliver Client and binds an unauthenticated HTTP and SSE interface to `localhost:8080` by default. The service returns a permissive `Access-Control-Allow-Origin: *` header on all responses.

Because this server is client-side, the attack surface is distributed across every individual operator in the operation. Any arbitrary website can issue cross-origin requests and interact with the MCP interface via an operator's browser, no credentials required.

If the interface is misconfigured to bind to all interfaces (`0.0.0.0`), the vulnerability escalates from a client-side CSRF/CORS issue to direct, unauthenticated remote access from any actor on the network.


## Exposed Methods
Exploitation grants unauthorized access to the following MCP tools:
- `list_sessions_and_beacons`
- `fs_ls`, `fs_pwd`, `fs_cd`
- `fs_cat`
- `fs_rm`, `fs_mv`, `fs_cp`, `fs_mkdir`
- `fs_chmod`, `fs_chown`

## PoC 
1. Start the Sliver client with MCP enabled (default `localhost:8080`)
2. Open a browser and load a page containing the [Proof of Concept JavaScript](https://github.com/skoveit/CVE-2026-34227).
3. Observe that the page successfully lists sessions and can issue filesystem commands against live implants, with no authentication

## Impact Assessment
Successful exploitation results in total operational compromise.
- **Direct Infrastructure Exposure:** If misconfigured to `0.0.0.0`, the C2 framework becomes fully accessible to any actor on the network or internet without requiring operator interaction.
- **Information Leakage:** Complete visibility into active sessions, deployed beacons, and file system structures (`list_sessions_and_beacons`, `fs_ls`, `fs_pwd`).
- **Arbitrary File Read:** Covert exfiltration of any target data (e.g., SSH keys, `ntds.dit`) through the C2 channel (`fs_cat`).
- **Integrity & Availability Loss:** Arbitrary deletion or modification of files on compromised targets, leading to potential sabotage or denial of service (`fs_rm`, `fs_mv`, `fs_cp`).

**Severity: Critical**



## Attack Scenarios
**Scenario 1: Data Exfiltration via Drive-by Execution (Default Localhost)** An operator clicks a link to a benign-looking site hosting malicious JavaScript (e.g. via open redirect). The script executes commands against `localhost:8080`, retrieves the operator's target list, and silently downloads sensitive files (e.g., a target's `ntds.dit`) using the operator's existing C2 connections.

 **Scenario 2: Campaign Neutralization (Default Localhost)** A malicious site lures an operator to a controlled domain. Embedded JavaScript immediately issues `fs_rm` commands across all active implants, mass-deleting