A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser.

Description

The Sliver MCP server runs inside the Sliver Client and binds an unauthenticated HTTP and SSE interface to localhost:8080 by default. The service returns a permissive Access-Control-Allow-Origin: * header on all responses.

Because this server is client-side, the attack surface is distributed across every individual operator in the operation. Any arbitrary website can issue cross-origin requests and interact with the MCP interface via an operator's browser, no credentials required.

If the interface is misconfigured to bind to all interfaces (0.0.0.0), the vulnerability escalates from a client-side CSRF/CORS issue to direct, unauthenticated remote access from any actor on the network.

Exposed Methods

Exploitation grants unauthorized access to the following MCP tools:

• list_sessions_and_beacons
• fs_ls, fs_pwd, fs_cd
• fs_cat
• fs_rm, fs_mv, fs_cp, fs_mkdir
• fs_chmod, fs_chown

PoC

1. Start the Sliver client with MCP enabled (default localhost:8080)
2. Open a browser and load a page containing the Proof of Concept JavaScript.
3. Observe that the page successfully lists sessions and can issue filesystem commands against live implants, with no authentication

Impact Assessment

Successful exploitation results in total operational compromise.

• Direct Infrastructure Exposure: If misconfigured to 0.0.0.0, the C2 framework becomes fully accessible to any actor on the network or internet without requiring operator interaction.
• Information Leakage: Complete visibility into active sessions, deployed beacons, and file system structures (list_sessions_and_beacons, fs_ls, fs_pwd).
• Arbitrary File Read: Covert exfiltration of any target data (e.g., SSH keys, ntds.dit) through the C2 channel (fs_cat).
• Integrity & Availability Loss: Arbitrary deletion or modification of files on compromised targets, leading to potential sabotage or denial of service (fs_rm, fs_mv, fs_cp).

Severity: Critical

Attack Scenarios

Scenario 1: Data Exfiltration via Drive-by Execution (Default Localhost) An operator clicks a link to a benign-looking site hosting malicious JavaScript (e.g. via open redirect). The script executes commands against localhost:8080, retrieves the operator's target list, and silently downloads sensitive files (e.g., a target's ntds.dit) using the operator's existing C2 connections.

Scenario 2: Campaign Neutralization (Default Localhost) A malicious site lures an operator to a controlled domain. Embedded JavaScript immediately issues fs_rm commands across all active implants, mass-deleting beacons and permanently severing operator access to the target network in a single click.

Scenario 3: Direct Takeover (0.0.0.0 Misconfiguration) An operator configures the MCP interface to listen on 0.0.0.0 for team access. An external attacker scans the network, discovers the exposed port, and directly issues unauthenticated API calls to hijack active sessions, drop connections, or exfiltrate data.

Technical Root Cause

The vulnerability stems from an insecure integration with the mcp-go library. While the library hardcodes permissive CORS (Access-Control-Allow-Origin: *), it also fails to validate the Content-Type header. This allows an attacker to use Simple Requests (e.g., text/plain) to bypass the browser's CORS preflight (OPTIONS) check entirely, making the attack highly reliable across all modern browsers without any additional techniques.

Furthermore, the Sliver implementation fails to implement any authentication middleware or origin restrictions to protect the sensitive RPC interface, meaning even if the CORS behavior were corrected upstream in mcp-go, the endpoint would remain fully unauthenticated.

Demo