Executive brief
OpenBullet2, an automation suite often used for web testing, contains a security flaw on Windows systems that can expose user credentials. By providing a malicious file path to the application, an attacker can force the software to attempt a connection to their own server. This process automatically shares the user's encrypted login credentials (NTLMv2 hash), which the attacker can then attempt to crack or reuse to gain unauthorized access to the victim's network or computer.
Technical details
A credential disclosure vulnerability exists in OpenBullet2 (up to v0.3.2) when running on Windows. The application fails to properly validate proxy source paths, allowing an attacker with low privileges to input a Universal Naming Convention (UNC) path (e.g., \\attacker-ip\share). When a job is initiated, the application attempts to load proxies from this path via the SMB protocol. This triggers an automatic Windows authentication attempt, sending the NTLMv2 hash of the user account running the OpenBullet2 process to the attacker-controlled server. The captured hash can subsequently be used in NTLM relay attacks or cracked offline to recover the plaintext password.
Affected products
- OpenBullet2 OpenBullet2 through 0.3.2
Timeline
- 2026-06-08: disclosed
- 2026-06-08: advisory