Unauthenticated Command Execution in Clash Verge Rev

Clash Verge Rev versions 2.2.3 and earlier contain an unauthenticated API endpoint at 127.0.0.1:33211/start_clash. The clash-verge-service, which typically operates with elevated system-level privileges (root or SYSTEM), fails to implement authentication for this interface. By sending a crafted JSON payload containing user-controlled parameters, including 'bin_path', 'config_dir', 'config_file', and 'log_file', an attacker can achieve arbitrary command execution on the host machine.

The vulnerability is particularly critical because the service executes provided parameters as system commands. Attackers can exploit this locally for privilege escalation or remotely via DNS Rebinding attacks - leveraging the 0.0.0.0-day behavior in specific browsers - or by chaining the attack through an exposed local network proxy. Defenders should prioritize patching or restricting access to the local API service immediately, as functional proof-of-concept exploits are publicly available.

Attack Chain

1. Attacker hosts a malicious web page designed to perform DNS Rebinding or prepares a local script for LPE.
2. Victim machine accesses the malicious page or is targeted via a reachable local network proxy.
3. The attacker issues a POST request to the local API endpoint at http://127.0.0.1:33211/start_clash.
4. The request includes a JSON body with malicious parameters (e.g., 'bin_path' pointing to an attacker-controlled binary or script).
5. The clash-verge-service receives the request and processes the 'bin_path' parameter without authentication or sanitization.
6. The service executes the specified binary or script using the elevated privileges of the service process.
7. The arbitrary command executes with root or SYSTEM-level permissions, completing privilege escalation or remote code execution.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands with the same privileges as the clash-verge-service (SYSTEM or root). This results in full system compromise, persistent unauthorized access, and potential data exfiltration. Given the nature of the application and the availability of exploitation vectors, unpatched instances are at high risk.

Recommendation

• Update Clash Verge Rev to the latest patched version immediately to remediate CVE-2025-50505.
• Implement host-based firewall rules to restrict access to the local loopback port 33211 to authorized processes only.
• Enable browser protections that mitigate DNS Rebinding and Private Network Access (PNA) risks.
• Monitor process creation logs for unexpected binaries or scripts being spawned by the 'clash-verge-service' process or related child processes.