← voltar
CVE-2025-27090

Server-Side Request Forgery (SSRF) in sliver teamserver

CVSS 6.9 MEDIUMEPSS 0.6%CWE-918
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 6.9EPSS 0.6%KEV nãoPoC Nuclei Metasploit Patch
Ciclo de vida
19 fev 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so. The only impact that has been shown is the exposure of the server's IP address to a third party. This issue has been addressed in version 1.5.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
BishopFox · sliver

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →