| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/bishopfox/sliver | < 1.7.4 | 1.7.4 |
| sliver | < 1.7.4 | 1.7.4 |
A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser.
The Sliver MCP server runs inside the Sliver Client and binds an unauthenticated HTTP and SSE interface to localhost:8080 by default. The service returns a permissive Access-Control-Allow-Origin: * header on all responses.
Because this server is client-side, the attack surface is distributed across every individual operator in the operation. Any arbitrary website can issue cross-origin requests and interact with the MCP interface via an operator's browser, no credentials required.
If the interface is misconfigured to bind to all interfaces (0.0.0.0), the vulnerability escalates from a client-side CSRF/CORS issue to direct, unauthenticated remote access from any actor on the network.
Exploitation grants unauthorized access to the following MCP tools:
list_sessions_and_beaconsfs_ls, fs_pwd, fs_cdfs_catfs_rm, fs_mv, fs_cp, fs_mkdirfs_chmod, fs_chownlocalhost:8080)Successful exploitation results in total operational compromise.
0.0.0.0, the C2 framework becomes fully accessible to any actor on the network or internet without requiring operator interaction.list_sessions_and_beacons, fs_ls, fs_pwd).Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freentds.ditfs_catfs_rm, fs_mv, fs_cp).Severity: Critical
Scenario 1: Data Exfiltration via Drive-by Execution (Default Localhost) An operator clicks a link to a benign-looking site hosting malicious JavaScript (e.g. via open redirect). The script executes commands against localhost:8080, retrieves the operator's target list, and silently downloads sensitive files (e.g., a target's ntds.dit) using the operator's existing C2 connections.
Scenario 2: Campaign Neutralization (Default Localhost) A malicious site lures an operator to a controlled domain. Embedded JavaScript immediately issues fs_rm commands across all active implants, mass-deleting beacons and permanently severing operator access to the target network in a single click.
Scenario 3: Direct Takeover (0.0.0.0 Misconfiguration) An operator configures the MCP interface to listen on 0.0.0.0 for team access. An external attacker scans the network, discovers the exposed port, and directly issues unauthenticated API calls to hijack active sessions, drop connections, or exfiltrate data.
The vulnerability stems from an insecure integration with the mcp-go library. While the library hardcodes permissive CORS (Access-Control-Allow-Origin: *), it also fails to validate the Content-Type header. This allows an attacker to use Simple Requests (e.g., text/plain) to bypass the browser's CORS preflight (OPTIONS) check entirely, making the attack highly reliable across all modern browsers without any additional techniques.
Furthermore, the Sliver implementation fails to implement any authentication middleware or origin restrictions to protect the sensitive RPC interface, meaning even if the CORS behavior were corrected upstream in mcp-go, the endpoint would remain fully unauthenticated.