Covenant
Monthly
Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. Exploitation requires only network reachability to the operator server - no credentials, user interaction, or non-default configuration - and while no public exploit identified at time of analysis and no CISA KEV listing was observed, the missing authentication check makes abuse straightforward for anyone with that access.
Covenant C2 framework (0.1.3-0.5) allows forging JWT tokens with admin roles due to hardcoded credentials. Attackers can upload and execute DLL payloads for RCE. PoC available.
Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. Exploitation requires only network reachability to the operator server - no credentials, user interaction, or non-default configuration - and while no public exploit identified at time of analysis and no CISA KEV listing was observed, the missing authentication check makes abuse straightforward for anyone with that access.
Covenant C2 framework (0.1.3-0.5) allows forging JWT tokens with admin roles due to hardcoded credentials. Attackers can upload and execute DLL payloads for RCE. PoC available.