CVE-2026-61554: emp3r0r HTTP polling unauthenticated DoS

Executive brief

emp3r0r is a command-and-control (C2) framework used by attackers to remotely control compromised systems. The HTTP polling transport feature fails to authenticate HTTP requests before accepting and processing them. An unauthenticated remote attacker can send repeated HTTP requests to create polling sessions and queue arbitrary data, consuming server resources and degrading C2 availability.

Technical details

The vulnerability is a pre-authentication resource consumption flaw (CWE-400) in emp3r0r's HTTP polling C2 transport. The HTTP server accepts user-supplied sessionID cookies and init=1 parameters to create server-side streams in HandleHTTPServerSession, without validating client authentication. POST request bodies are then read and queued into the stream's readCh channel before CBOR MsgAuth authentication occurs in the dispatcher layer. An attacker can exploit this by sending HTTP POST requests to /api/v1/telemetry with arbitrary payloads, causing the server to queue data and spawn goroutines to handle each unauthenticated session. Repeating this concurrently consumes memory, goroutines, log volume, and request handling capacity. The PoC demonstrates that attacker-controlled bytes (0x41414141 = AAAA) reach the C2 frame parser before authentication. Fix: require authentication before creating sessions, validate bodies before queuing, and enforce strict request size limits.

Affected products

• jm33-m0 emp3r0r < 0.0.0-20260531142011-aed3d81641ab

Timeline

• 2026-09-15: disclosed: GitHub Advisory GHSA-4595-rvpx-4q34 published
• 2026-05-31: patched: Fixed in version 0.0.0-20260531142011-aed3d81641ab

References

• https://api.github.com/users/blankshiro
• https://github.com/blankshiro
• https://api.github.com/users/blankshiro/gists%7B/gist_id%7D
• https://api.github.com/users/blankshiro/repos
• https://avatars.githubusercontent.com/u/61448100?v=4
• https://api.github.com/users/blankshiro/events%7B/privacy%7D