Xtle0O0

**Name of the Vulnerable Software and Affected Versions** emp3r0r versions prior to 3.21.2 **Description** The software accesses multiple shared maps without consistent synchronization across goroutines. Concurrent activity can trigger a `fatal error: concurrent map read and map write`, leading to a C2 process crash and resulting in availability loss. The issue stems from mixed access patterns (iteration and mutation) without a single lock policy in maps such as the operator session map, port-forwarding session map, and FTP stream map. An attacker can trigger high concurrency, such as through rapid operator session churn and simultaneous agent message traffic, to exploit this condition. This results in a denial of service as the C2 component exits due to the panic. **Recommendations** Versions prior to 3.21.2 should be updated to version 3.21.2 or later.

**Name of the Vulnerable Software and Affected Versions** emp3r0r versions prior to 3.21.1 **Description** emp3r0r is a command and control (C2) tool designed for Linux environments. Versions prior to 3.21.1 accept untrusted agent metadata, specifically `Transport` and `Hostname`, during the check-in process. This metadata is then used in tmux shell command strings executed via `/bin/sh -c`, leading to command injection and potential remote code execution on the operator host. **Recommendations** Update to version 3.21.1 or later.

**Name of the Vulnerable Software and Affected Versions** Sliver versions prior to 1.7.0 **Description** The DNS command and control (C2) listener accepts unauthenticated Time-based One-Time Password (TOTP) bootstrap messages and allocates server-side DNS sessions without validating the OTP values, even when `EnforceOTP` is enabled. Sessions are stored indefinitely in this flow, allowing an unauthenticated remote actor to repeatedly create sessions and exhaust server memory. The vulnerable code resides in `server/c2/dns.go` (lines 84-90, 378-390, 490-521), `client/command/jobs/dns.go` (lines 46-52), `implant/sliver/transports/dnsclient/dnsclient.go` (lines 896-900), and `protobuf/dnspb/dns.proto` (line 22). The attack vector involves sending repeated DNS queries with a minimal protobuf message of type `TOTP` to the network-accessible DNS listener. The `DNSMessageType TOTP` bootstrap handling path is the trigger. This can lead to an unauthenticated remote denial of service through resource exhaustion. **Recommendations** Versions prior to 1.7.0 should be updated to version 1.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** Sliver versions prior to 1.6.11 **Description** Sliver is a command and control framework that utilizes a custom Wireguard netstack. A path traversal issue exists in the website content subsystem, allowing an authenticated operator to read arbitrary files on the Sliver server host. This can expose sensitive data such as operator configurations, TLS keys, tokens, and logs. The issue stems from the server accepting and persisting arbitrary website paths from the operator without proper sanitization or containment, and subsequently reading from disk using these paths. The vulnerable components include the website content management (gRPC): `WebsiteAddContent`, `Website`, and `Websites`, as well as the server-side file read in `Website.ToProtobuf`. The issue requires an authenticated operator account with sufficient permissions. A proof of concept demonstrates the ability to read files like `/etc/hosts`. **Recommendations** Versions prior to 1.6.11 should be updated to version 1.6.11 or later. Validate and reject paths that are absolute or contain '..' in `WebsiteAddContent` (server side). Canonicalize paths and enforce they remain within the web content directory. Avoid reading content by `Path` in `Website.ToProtobuf`; read by content ID instead.