Hermes WebUI is a web-based application that allows users to manage and monitor various server processes through a graphical interface. It is used by system administrators to facilitate the management of software services and provide an overview of server performance. Hermes WebUI is popular for its user-friendly interface and extensive functionalities in server management environments. Organizations utilize this tool to improve operational efficiency by reducing manual server management tasks. The software is employed in diverse industries, including technology firms, data centers, and enterprises requiring efficient server monitoring solutions. Hermes WebUI is designed to be a robust platform that integrates with other tools for comprehensive server management capabilities.
The vulnerability detected in Hermes WebUI is a Remote Code Execution (RCE) flaw that allows attackers to run arbitrary commands on the system. It arises from improper access control in certain API endpoints within the software, specifically the embedded terminal API. This access flaw enables remote attackers to exploit the terminal API endpoints without needing authentication or credentials. As a critical severity vulnerability, it poses a significant security risk, potentially leading to unauthorized system access. The vulnerability is found in versions of Hermes WebUI before 0.51.788, making these installations vulnerable to attacks.
The technical details of this vulnerability involve the misuse of session API calls and terminal inputs, allowing attackers to initiate sessions and inject command data without authentication. Specifically, the vulnerable endpoints '/api/session/new' and '/api/terminal/start' are used to start a session, while '/api/terminal/input' enables attackers to input commands. The combination of these endpoints without requiring authentication creates an exploit path for Remote Code Execution. Attackers take advantage of this by crafting specific POST requests that bypass access controls and execute commands as the server process user.
When exploited, this vulnerability can lead to complete system compromise, allowing attackers to execute shell commands as the server user. This level of access provides the potential for significant damage, including data theft, server manipulation, and unauthorized access to sensitive information. The exploitation could extend to complete control over the infected server, making it possible to install malicious software or use the server as a platform for further attacks within the network. The unauthorized access could disrupt services and lead to operational downtime.
REFERENCES
- Update Hermes WebUI to version 0.51.788 or later to mitigate the vulnerability.
- Implement strict access controls to limit API endpoint accessibility only to authorized users.
- Regularly audit server logs for suspicious activity indicating exploitation attempts.
- Consider deploying a Web Application Firewall (WAF) to detect and block malicious requests.
- Ensure secure coding practices are followed to prevent similar vulnerabilities in the future.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →