Executive brief
Sliver is a command and control (C2) framework used by security professionals to manage simulated cyberattacks. A vulnerability in its management interface allows an attacker to take over active sessions if an operator clicks a malicious link. This could result in the theft of sensitive data like SSH keys or the complete destruction of the testing infrastructure.
Technical details
The Sliver MCP (Multi-Client Protocol) server, which typically binds to localhost:8080, lacks authentication and implements a permissive CORS policy (Access-Control-Allow-Origin: *). Because the server fails to validate the Content-Type header, attackers can use 'Simple Requests' to bypass CORS preflight checks. An attacker can use Cross-Site Request Forgery (CSRF) via a malicious website to execute commands through the operator's browser, such as listing sessions, reading files (fs_cat), or deleting files (fs_rm). If the interface is misconfigured to bind to 0.0.0.0, it becomes directly accessible over the network without user interaction. The issue is patched in version 1.7.4.
Affected products
- BishopFox Sliver < 1.7.4
Timeline
- 2026-03-30: advisory: GitHub/Vendor advisory published
- 2026-03-31: disclosed: NVD publication date
- 2026-03-31: patched: Fixed in version 1.7.4