Unauthenticated Remote Code Execution in Hermes WebUI

Executive Summary

This vulnerability exists in Hermes WebUI versions before 0.51.788 and allows unauthenticated remote attackers to execute arbitrary shell commands on the server.

Attackers can exploit the embedded terminal API endpoints without needing any credentials by creating a session, attaching a PTY shell, and sending commands through the terminal input endpoint.

This process requires four sequential unauthenticated HTTP requests and results in full command execution with the privileges of the server process user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows remote attackers to execute arbitrary commands on the affected server without authentication.

An attacker could potentially take full control of the server process, leading to data theft, service disruption, installation of malware, or further network compromise.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated remote code execution on the Hermes WebUI server, enabling attackers to execute arbitrary shell commands as the server process user. This unauthorized access and control over the server could lead to unauthorized data access, data breaches, or manipulation of sensitive information.

Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and systems to protect privacy and ensure data security.

Therefore, if exploited, this vulnerability could result in violations of these regulations due to failure to adequately protect systems from unauthorized access and execution of arbitrary commands.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Hermes WebUI version in use is before 0.51.788, as versions prior to this contain the unauthenticated remote code execution flaw.

To detect potential exploitation attempts on your network or system, monitor for unauthenticated HTTP requests targeting the embedded terminal API endpoints such as /api/terminal/start, /api/terminal/input, /api/terminal/resize, /api/terminal/close, and /api/terminal/output.

Suggested commands include using network monitoring tools like curl or wget to test access to these endpoints without authentication, for example:

• curl -v http://<hermes-webui-host>:<port>/api/terminal/start
• curl -v http://<hermes-webui-host>:<port>/api/terminal/input

Additionally, inspecting server logs for unauthenticated access attempts to these endpoints or unusual shell command executions can help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Hermes WebUI to version 0.51.788 or later, where the vulnerability has been fixed by gating embedded-terminal HTTP endpoints to local-origin requests when authentication is disabled.

If upgrading is not immediately possible, restrict network access to the Hermes WebUI server so that the embedded terminal API endpoints are only accessible from trusted local or private network origins.

Enable authentication on the Hermes WebUI to prevent unauthenticated access to terminal endpoints.

Consider using additional access controls such as reverse proxy authentication, VPNs, or firewall rules to limit exposure of the vulnerable endpoints.

Useful 0 Not Useful 0