Unauthenticated Denial of Service in emp3r0r HTTP Polling Transport

The emp3r0r Command and Control (C2) server is susceptible to an unauthenticated denial-of-service (DoS) vulnerability, tracked as CVE-2026-61554. The flaw exists within the http_poll transport mechanism, which improperly handles HTTP sessions by allowing them to be created and populated with data prior to performing CBOR MsgAuth authentication.

An attacker can send unauthenticated HTTP POST requests to the C2 polling endpoint, providing an arbitrary sessionID and init=1 cookie. The server processes these requests and forwards the body data into the C2 dispatch path before any authentication checks occur. By sending repeated, crafted requests, an attacker can consume system resources, including memory, goroutines, and logging capacity, leading to a degradation or total loss of C2 service availability. This issue affects versions of the emp3r0r core package prior to 0.0.0-20260531142011-aed3d81641ab.

Attack Chain

1. Attacker identifies an internet-facing emp3r0r C2 server exposing the HTTP polling port.
2. Attacker sends an initial HTTP POST request to the C2 endpoint (e.g., /api/v1/telemetry) with init=1 and a chosen sessionID cookie.
3. Server-side code calls newHTTPServerStream, creating and storing an unauthenticated stream object.
4. Attacker sends subsequent HTTP POST requests to the same endpoint using the established sessionID.
5. The server invokes io.ReadAll(req.Body) on the unauthenticated session and queues the data into the internal stream.readCh.
6. Attacker-controlled data is forwarded into the C2 dispatch layer before the CBOR authentication process is reached.
7. Attacker repeats the request cycle to maximize resource consumption, triggering a server DoS.

Impact

Successful exploitation allows for the degradation of C2 infrastructure availability. By forcing the server to process and queue unauthenticated request bodies, an attacker can exhaust server-side resources, including goroutines and memory. This is particularly impactful for threat actors relying on the integrity and uptime of their C2 infrastructure for post-exploitation operations.

Recommendation

Prioritize the upgrade of all internet-facing emp3r0r C2 instances to version 0.0.0-20260531142011-aed3d81641ab or later. If patching is not immediately feasible, restrict access to the HTTP polling endpoint using network-level controls such as firewalls or VPNs to ensure only authorized traffic can reach the listener.