CVE-2026-107337 in Malcolm
Summary
by MITRE • 10/08/2026
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in the Malcolm kiosk Flask application represents a critical combination of authentication bypass and cross-site request forgery flaws that compromise the integrity and availability of network forensics infrastructure. The core technical flaw lies in the configuration of the POST /script_call/ endpoint, which is exposed without any form of user authentication or session validation. This lack of access control allows unauthenticated actors to interact directly with backend management functions. Furthermore, the application implements wildcard Cross-Origin Resource Sharing (CORS) by invoking CORS(app), a misconfiguration that effectively disables browser-based origin checks for all requests originating from this endpoint. By allowing any domain to make cross-origin POST requests, the application inadvertently provides an attack vector for malicious websites or phishing campaigns to trigger actions on behalf of authenticated users without their knowledge or consent.
The operational impact of these combined vulnerabilities is severe and potentially catastrophic for security operations centers relying on Malcolm for traffic analysis and incident response. An attacker can craft a malicious webpage that automatically sends forged POST requests to the /script_call/ endpoint when an operator visits it while logged into the kiosk interface. This cross-site request forgery attack enables the execution of arbitrary management commands with the privileges of the web server process. Specifically, the ability to invoke control.py --wipe allows for the permanent deletion of all captured network traffic and forensic logs. In a security context where data retention is critical for post-incident analysis, compliance auditing, and threat hunting, this action results in total loss of historical evidence, rendering any ongoing investigation impossible and potentially violating regulatory requirements for log preservation.
Beyond data destruction, the vulnerability also facilitates denial-of-service conditions through the execution of control.py --stop. This command effectively blinds the security monitoring infrastructure by halting the Malcolm services responsible for packet capture and analysis. An attacker can disrupt visibility into network activity, creating a window of opportunity for further malicious activities to go undetected. The combination of data erasure and service disruption demonstrates how authentication bypasses coupled with weak CORS policies can escalate from simple information disclosure or minor disruptions to complete compromise of the security monitoring posture.
To mitigate these risks, immediate remediation steps must focus on enforcing strict access controls and tightening browser security headers. First, all administrative endpoints, particularly those triggering system-level commands like /script_call/, must require robust authentication mechanisms such as multi-factor authentication or strong session-based token validation. Second, the wildcard CORS configuration should be replaced with a restrictive policy that explicitly lists only trusted origins allowed to make cross-origin requests. If possible, these management functions should not rely on browser-initiated POST requests at all but instead use secure API gateways with mutual TLS or signed request verification. Additionally, implementing anti-CSRF tokens for state-changing operations provides an additional layer of defense against forged requests. Regular security audits and penetration testing are recommended to ensure that similar misconfigurations do not exist elsewhere in the application stack, ensuring the resilience of critical forensic tools against both external attacks and insider threats facilitated by social engineering.