CVE-2026-53649 (GCVE-0-2026-53649)

Vulnerability from cvelistv5 – Published: 2026-09-02 17:21 – Updated: 2026-09-04 02:49

Title

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Summary

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 02:49 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-352 - Cross-Site Request Forgery (CSRF)
CWE-434 - Unrestricted Upload of File with Dangerous Type
CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7634 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/BishopFox/joro/security/adviso…	x_refsource_CONFIRM
https://github.com/BishopFox/joro/releases/tag/1.1.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
BishopFox	joro	Affected: < 1.1.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53649",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:49:19.391428Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T02:49:30.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "joro",
          "vendor": "BishopFox",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Joro is a web exploitation framework. Prior to version 1.1.1, Joro\u0027s default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator\u0027s browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator\u0027s user from a single page visit. This issue has been patched in version 1.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T17:21:39.908Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc"
        },
        {
          "name": "https://github.com/BishopFox/joro/releases/tag/1.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BishopFox/joro/releases/tag/1.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-xqhv-chqm-fhcc",
        "discovery": "UNKNOWN"
      },
      "title": "Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53649",
    "datePublished": "2026-09-02T17:21:39.908Z",
    "dateReserved": "2026-06-09T20:50:36.876Z",
    "dateUpdated": "2026-09-04T02:49:30.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53649",
      "date": "2026-10-21",
      "epss": "0.0033",
      "percentile": "0.24793"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "joro",
                "vendor": "BishopFox",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.1.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Joro is a web exploitation framework. Prior to version 1.1.1, Joro\u0027s default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator\u0027s browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator\u0027s user from a single page visit. This issue has been patched in version 1.1.1."
          }
        ],
        "id": "CVE-2026-53649",
        "lastModified": "2026-09-09T21:09:13.080",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 6.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-53649",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:49:19.391428Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-02T18:19:59.973",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/BishopFox/joro/releases/tag/1.1.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-306"
              },
              {
                "lang": "en",
                "value": "CWE-352"
              },
              {
                "lang": "en",
                "value": "CWE-434"
              },
              {
                "lang": "en",
                "value": "CWE-942"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-53649",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T02:49:19.391428Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T02:49:25.983Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "joro",
              "vendor": "BishopFox",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.1.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Joro is a web exploitation framework. Prior to version 1.1.1, Joro\u0027s default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator\u0027s browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator\u0027s user from a single page visit. This issue has been patched in version 1.1.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306: Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-434",
                  "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-942",
                  "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-02T17:21:39.908Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc"
            },
            {
              "name": "https://github.com/BishopFox/joro/releases/tag/1.1.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/BishopFox/joro/releases/tag/1.1.1"
            }
          ],
          "source": {
            "advisory": "GHSA-xqhv-chqm-fhcc",
            "discovery": "UNKNOWN"
          },
          "title": "Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-53649",
        "datePublished": "2026-09-02T17:21:39.908Z",
        "dateReserved": "2026-06-09T20:50:36.876Z",
        "dateUpdated": "2026-09-04T02:49:30.222Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53649

Vulnerability from fkie_nvd - Published: 2026-09-02 18:19 - Updated: 2026-09-09 21:09

Severity

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/BishopFox/joro/releases/tag/1.1.1
	security-advisories@github.com	https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "joro",
          "vendor": "BishopFox",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Joro is a web exploitation framework. Prior to version 1.1.1, Joro\u0027s default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator\u0027s browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator\u0027s user from a single page visit. This issue has been patched in version 1.1.1."
    }
  ],
  "id": "CVE-2026-53649",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53649",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-04T02:49:19.391428Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-02T18:19:59.973",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/BishopFox/joro/releases/tag/1.1.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        },
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XQHV-CHQM-FHCC

Vulnerability from github – Published: 2026-07-08 20:27 – Updated: 2026-07-08 20:27

Summary

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Details

Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0)

Severity: Critical CVSS v3.1: 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Affected versions: Joro ≤ v1.1.0, proxy mode (default), Linux/macOS Reporter: cstover Date: 2026-05-27

Summary

Joro's default proxy mode (in versions <= 1.1.0) exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit.

Root Cause

Three weaknesses combined into the exploit chain.

1. No authentication in proxy mode. internal/api/server.go applied AuthMiddleware only when listenerMode was true. In the default proxy mode every API endpoint — including plugin upload and system restart — accepted requests without any token, cookie, or credential.

2. Permissive CORS with an insufficient protection assumption. corsMiddleware set Access-Control-Allow-Origin: * unconditionally on all responses. SECURITY.md documented this as an intentional tradeoff on the basis that proxy mode binds to 127.0.0.1, which the document states "limits exposure to the local machine."

That assumption was incorrect. multipart/form-data is a CORS-safelisted Content-Type, so cross-origin JavaScript can POST files to the Joro API without triggering a preflight request — the browser allows it. Any web page the operator visited reached the localhost API through their browser without restriction. The localhost bind provided no protection against browser-mediated requests.

3. Plugin init() executed on plugin.Open() before symbol lookup. internal/plugins/loader.go called plugin.Open(), which ran the plugin's init() functions before any symbol lookup occurred. A plugin with no exports still executed its payload the moment Joro restarted.

Attack Chain

The operator visits an attacker-controlled page in Firefox on their machine.
JavaScript on the page fetches pwn.so from the attacker's server (same-origin, no CORS issue).
JavaScript POSTs pwn.so to http://127.0.0.1:9090/api/v1/plugins/upload as multipart/form-data. Joro accepts it — no auth, no preflight.
JavaScript POSTs to http://127.0.0.1:9090/api/v1/system/restart. Joro re-executes.
On restart, plugin.Open("pwn.so") calls init(), which opens a goroutine and dials back to the attacker's listener.
An interactive /bin/bash -i shell is obtained as the operator's user.

The plugin ABI matches without any access to the operator's machine. The same public v1.1.0 release tarball is downloaded and Joro's own --build-plugin feature is used, which reads runtime/debug.BuildInfo from the release binary and forwards every ABI-relevant flag. One .so works against every operator running that release.

Impact

Unauthenticated, remote, browser-mediated code execution as the operator's user. Because the exploit pivots through the operator's browser to the loopback-bound API, the network bind offers no protection, and a single ABI-matched plugin works against every operator running the affected release.

Fix

The chain is broken at multiple layers. Cross-origin browser access to the proxy-mode API is eliminated, the API is restricted to same-origin requests targeting a loopback host, and the UI/API is bound to loopback only.

1. Removed the wildcard CORS header and gated the proxy-mode API behind a same-origin guard

corsMiddleware (which set Access-Control-Allow-Origin: * on every response) was deleted, and proxy mode now wraps the API in originGuard instead. (internal/api/server.go, commit 5c0ca35)

 var handler http.Handler = mux
 if s.listenerMode {
+     // Listener/teamserver: bearer-token auth.
      handler = team.AuthMiddleware(s.teamToken, handler)
+} else {
+     // Proxy mode: restrict the API to same-origin browser requests.
+     handler = originGuard(uiBind, handler)
 }
-handler = corsMiddleware(handler)

-// corsMiddleware adds permissive CORS headers for dev usage.
-func corsMiddleware(next http.Handler) http.Handler {
-     return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-             w.Header().Set("Access-Control-Allow-Origin", "*")
-             w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
-             w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Joro-Nickname")
-             if r.Method == http.MethodOptions {
-                     w.WriteHeader(http.StatusNoContent)
-                     return
-             }
-             next.ServeHTTP(w, r)
-     })
-}

2. Same-origin enforcement via `Sec-Fetch-Site` + `Origin`/`Host`

originGuard rejects state-changing requests (and the /ws upgrade) whose Sec-Fetch-Site indicates a cross-origin initiator or whose Origin host does not match the request Host. Non-browser local tooling (no browser headers) is still allowed. (internal/api/originguard.go, commit 5c0ca35)

func isMutating(method string) bool {
      switch method {
      case http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch:
              return true
      default:
              return false
      }
}

func sameOrigin(r *http.Request) bool {
      switch r.Header.Get("Sec-Fetch-Site") {
      case "", "same-origin", "none":
              // Same-origin, a direct navigation, or a non-browser client.
      default: // "cross-site", "same-site"
              return false
      }
      if origin := r.Header.Get("Origin"); origin != "" {
              if origin == "null" {
                      return false // opaque/sandboxed cross-origin context
              }
              u, err := url.Parse(origin)
              if err != nil || !strings.EqualFold(reqHostname(u.Host), reqHostname(r.Host)) {
                      return false
              }
      }
      return true
}

3. Tightened the WebSocket origin check

The WebSocket upgrader previously accepted every origin (CheckOrigin: return true). It now rejects cross-origin handshakes while still permitting non-browser clients. (internal/api/ws.go, commit 5c0ca35)

var upgrader = websocket.Upgrader{
-     CheckOrigin: func(r *http.Request) bool { return true },
+     CheckOrigin: func(r *http.Request) bool {
+             origin := r.Header.Get("Origin")
+             if origin == "" {
+                     return true
+             }
+             if origin == "null" {
+                     return false
+             }
+             u, err := url.Parse(origin)
+             if err != nil {
+                     return false
+             }
+             return strings.EqualFold(reqHostname(u.Host), reqHostname(r.Host))
+     },
 }

4. Bound the proxy-mode UI/API to loopback and removed the wildcard host exception

The same-origin check alone can be defeated by DNS rebinding under a wildcard bind, because a rebound host (e.g. attacker.com) carries consistent Origin/Host/Sec-Fetch-Site headers. Two coordinated changes close this: the proxy-mode UI/API now binds to 127.0.0.1 regardless of --bind (which governs only the proxy port), and hostAllowed no longer has a wildcard exception, so the host must be loopback or the exact bind address. (internal/api/server.go and internal/api/originguard.go, commit 871936f)

+// In proxy mode the UI/API binds to loopback only: --bind governs the proxy
+// port, and remote collaboration is listener/teamserver mode (bearer-token auth).
+uiBind := s.cfg.BindAddr
+if !s.listenerMode {
+     uiBind = "127.0.0.1"
+}
+
 var handler http.Handler = mux
 ...
 s.srv = &http.Server{
-     Addr:              fmt.Sprintf("%s:%d", s.cfg.BindAddr, s.cfg.UIPort),
+     Addr:              fmt.Sprintf("%s:%d", uiBind, s.cfg.UIPort),

 func hostAllowed(reqHost, bindAddr string) bool {
      h := reqHostname(reqHost)
      if h == "" {
              return false
      }
      switch h {
      case "localhost", "127.0.0.1", "::1":
              return true
      }
-     switch bindAddr {
-     case "", "0.0.0.0", "::":
-             return true
-     }
      return strings.EqualFold(h, reqHostname(bindAddr))
 }

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/BishopFox/joro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260601151442-5c0ca35db828"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53649"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-352",
      "CWE-434",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-08T20:27:02Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro \u2264 v1.1.0)\n\n**Severity:** Critical\n**CVSS v3.1:** 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)\n**Affected versions:** Joro \u2264 v1.1.0, proxy mode (default), Linux/macOS\n**Reporter:** cstover\n**Date:** 2026-05-27\n\n---\n\n## Summary\n\nJoro\u0027s default proxy mode (in versions \u003c= 1.1.0) exposes a local API on `127.0.0.1:9090` that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted `multipart/form-data` content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator\u0027s browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator\u0027s user from a single page visit.\n\n---\n\n## Root Cause\n\nThree weaknesses combined into the exploit chain.\n\n**1. No authentication in proxy mode.**\n`internal/api/server.go` applied `AuthMiddleware` only when `listenerMode` was `true`. In the default proxy mode every API endpoint \u2014 including plugin upload and system restart \u2014 accepted requests without any token, cookie, or credential.\n\n**2. Permissive CORS with an insufficient protection assumption.**\n`corsMiddleware` set `Access-Control-Allow-Origin: *` unconditionally on all responses. `SECURITY.md` documented this as an intentional tradeoff on the basis that proxy mode binds to `127.0.0.1`, which the document states \"limits exposure to the local machine.\"\n\nThat assumption was incorrect. `multipart/form-data` is a CORS-safelisted `Content-Type`, so cross-origin JavaScript can POST files to the Joro API without triggering a preflight request \u2014 the browser allows it. Any web page the operator visited reached the localhost API through their browser without restriction. The localhost bind provided no protection against browser-mediated requests.\n\n**3. Plugin `init()` executed on `plugin.Open()` before symbol lookup.**\n`internal/plugins/loader.go` called `plugin.Open()`, which ran the plugin\u0027s `init()` functions before any symbol lookup occurred. A plugin with no exports still executed its payload the moment Joro restarted.\n\n---\n\n## Attack Chain\n\n1. The operator visits an attacker-controlled page in Firefox on their machine.\n2. JavaScript on the page fetches `pwn.so` from the attacker\u0027s server (same-origin, no CORS issue).\n3. JavaScript POSTs `pwn.so` to `http://127.0.0.1:9090/api/v1/plugins/upload` as `multipart/form-data`. Joro accepts it \u2014 no auth, no preflight.\n4. JavaScript POSTs to `http://127.0.0.1:9090/api/v1/system/restart`. Joro re-executes.\n5. On restart, `plugin.Open(\"pwn.so\")` calls `init()`, which opens a goroutine and dials back to the attacker\u0027s listener.\n6. An interactive `/bin/bash -i` shell is obtained as the operator\u0027s user.\n\nThe plugin ABI matches without any access to the operator\u0027s machine. The same public v1.1.0 release tarball is downloaded and Joro\u0027s own `--build-plugin` feature is used, which reads `runtime/debug.BuildInfo` from the release binary and forwards every ABI-relevant flag. One `.so` works against every operator running that release.\n\n---\n\n## Impact\n\nUnauthenticated, remote, browser-mediated code execution as the operator\u0027s user. Because the exploit pivots through the operator\u0027s browser to the loopback-bound API, the network bind offers no protection, and a single ABI-matched plugin works against every operator running the affected release.\n\n## Fix\n\nThe chain is broken at multiple layers. Cross-origin browser access to the proxy-mode API is eliminated, the API is restricted to same-origin requests targeting a loopback host, and the UI/API is bound to loopback only.\n\n### 1. Removed the wildcard CORS header and gated the proxy-mode API behind a same-origin guard\n\n`corsMiddleware` (which set `Access-Control-Allow-Origin: *` on every response) was deleted, and proxy mode now wraps the API in `originGuard` instead. (`internal/api/server.go`, commit `5c0ca35`)\n\n```diff\n var handler http.Handler = mux\n if s.listenerMode {\n+     // Listener/teamserver: bearer-token auth.\n      handler = team.AuthMiddleware(s.teamToken, handler)\n+} else {\n+     // Proxy mode: restrict the API to same-origin browser requests.\n+     handler = originGuard(uiBind, handler)\n }\n-handler = corsMiddleware(handler)\n```\n\n```diff\n-// corsMiddleware adds permissive CORS headers for dev usage.\n-func corsMiddleware(next http.Handler) http.Handler {\n-     return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n-             w.Header().Set(\"Access-Control-Allow-Origin\", \"*\")\n-             w.Header().Set(\"Access-Control-Allow-Methods\", \"GET, POST, PUT, DELETE, OPTIONS\")\n-             w.Header().Set(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization, X-Joro-Nickname\")\n-             if r.Method == http.MethodOptions {\n-                     w.WriteHeader(http.StatusNoContent)\n-                     return\n-             }\n-             next.ServeHTTP(w, r)\n-     })\n-}\n```\n\n### 2. Same-origin enforcement via `Sec-Fetch-Site` + `Origin`/`Host`\n\n`originGuard` rejects state-changing requests (and the `/ws` upgrade) whose `Sec-Fetch-Site` indicates a cross-origin initiator or whose `Origin` host does not match the request `Host`. Non-browser local tooling (no browser headers) is still allowed. (`internal/api/originguard.go`, commit `5c0ca35`)\n\n```go\nfunc isMutating(method string) bool {\n      switch method {\n      case http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch:\n              return true\n      default:\n              return false\n      }\n}\n\nfunc sameOrigin(r *http.Request) bool {\n      switch r.Header.Get(\"Sec-Fetch-Site\") {\n      case \"\", \"same-origin\", \"none\":\n              // Same-origin, a direct navigation, or a non-browser client.\n      default: // \"cross-site\", \"same-site\"\n              return false\n      }\n      if origin := r.Header.Get(\"Origin\"); origin != \"\" {\n              if origin == \"null\" {\n                      return false // opaque/sandboxed cross-origin context\n              }\n              u, err := url.Parse(origin)\n              if err != nil || !strings.EqualFold(reqHostname(u.Host), reqHostname(r.Host)) {\n                      return false\n              }\n      }\n      return true\n}\n```\n\n### 3. Tightened the WebSocket origin check\n\nThe WebSocket upgrader previously accepted every origin (`CheckOrigin: return true`). It now rejects cross-origin handshakes while still permitting non-browser clients. (`internal/api/ws.go`, commit `5c0ca35`)\n\n```diff\nvar upgrader = websocket.Upgrader{\n-     CheckOrigin: func(r *http.Request) bool { return true },\n+     CheckOrigin: func(r *http.Request) bool {\n+             origin := r.Header.Get(\"Origin\")\n+             if origin == \"\" {\n+                     return true\n+             }\n+             if origin == \"null\" {\n+                     return false\n+             }\n+             u, err := url.Parse(origin)\n+             if err != nil {\n+                     return false\n+             }\n+             return strings.EqualFold(reqHostname(u.Host), reqHostname(r.Host))\n+     },\n }\n```\n\n### 4. Bound the proxy-mode UI/API to loopback and removed the wildcard host exception\n\nThe same-origin check alone can be defeated by DNS rebinding under a wildcard bind, because a rebound host (e.g. `attacker.com`) carries consistent `Origin`/`Host`/`Sec-Fetch-Site` headers. Two coordinated changes close this: the proxy-mode UI/API now binds to `127.0.0.1` regardless of `--bind` (which governs only the proxy port), and `hostAllowed` no longer has a wildcard exception, so the host must be loopback or the exact bind address. (`internal/api/server.go` and `internal/api/originguard.go`, commit `871936f`)\n\n```diff\n+// In proxy mode the UI/API binds to loopback only: --bind governs the proxy\n+// port, and remote collaboration is listener/teamserver mode (bearer-token auth).\n+uiBind := s.cfg.BindAddr\n+if !s.listenerMode {\n+     uiBind = \"127.0.0.1\"\n+}\n+\n var handler http.Handler = mux\n ...\n s.srv = \u0026http.Server{\n-     Addr:              fmt.Sprintf(\"%s:%d\", s.cfg.BindAddr, s.cfg.UIPort),\n+     Addr:              fmt.Sprintf(\"%s:%d\", uiBind, s.cfg.UIPort),\n```\n\n```diff\n func hostAllowed(reqHost, bindAddr string) bool {\n      h := reqHostname(reqHost)\n      if h == \"\" {\n              return false\n      }\n      switch h {\n      case \"localhost\", \"127.0.0.1\", \"::1\":\n              return true\n      }\n-     switch bindAddr {\n-     case \"\", \"0.0.0.0\", \"::\":\n-             return true\n-     }\n      return strings.EqualFold(h, reqHostname(bindAddr))\n }\n```",
  "id": "GHSA-xqhv-chqm-fhcc",
  "modified": "2026-07-08T20:27:02Z",
  "published": "2026-07-08T20:27:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BishopFox/joro/security/advisories/GHSA-xqhv-chqm-fhcc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BishopFox/joro"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53649 (GCVE-0-2026-53649)

FKIE_CVE-2026-53649

GHSA-XQHV-CHQM-FHCC

Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0)

Summary

Root Cause

Attack Chain

Impact

Fix

1. Removed the wildcard CORS header and gated the proxy-mode API behind a same-origin guard

2. Same-origin enforcement via Sec-Fetch-Site + Origin/Host

3. Tightened the WebSocket origin check

4. Bound the proxy-mode UI/API to loopback and removed the wildcard host exception

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

2. Same-origin enforcement via `Sec-Fetch-Site` + `Origin`/`Host`