Xiaobei (<= 5.5.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xiaobei--5.5.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 15:26:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated RCE and SSRF in xiaobei via Webhook Injectionhttps://feed.craftedsignal.io/briefs/2026-09-xiaobei-unauth-webhook/Fri, 04 Sep 2026 15:26:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-xiaobei-unauth-webhook/The xiaobei product through version 5.5.2 lacks authentication on webhook endpoints, enabling unauthenticated remote code execution via pipeline message injection and server-side request forgery (SSRF) via malicious media URL fetching.The xiaobei application, up to and including version 5.5.2, contains a critical vulnerability where webhook endpoints fail to implement necessary authentication or signature validation. This flaw allows unauthenticated remote attackers to interact directly with the application's internal messaging pipeline via the /webhook_worktool handler. By submitting crafted payloads, an attacker can inject arbitrary messages, leading to potential remote code execution (RCE) within the agent pipeline. Furthermore, the application processes media URLs provided via these webhooks without adequate validation. This behavior can be exploited by attackers to conduct server-side request forgery (SSRF) attacks, allowing them to probe or interact with services located within the internal network that are otherwise inaccessible from the public internet. Given the lack of defensive controls on these endpoints, organizations using xiaobei versions 5.5.2 and earlier are at high risk of unauthorized system access and internal service compromise.

Impact

Successful exploitation of CVE-2026-85667 allows an unauthenticated attacker to execute code within the agent pipeline and leverage the server to reach internal network resources. This poses a significant threat of data exfiltration, lateral movement, and total system compromise.

Recommendation

  • Immediately restrict network access to the /webhook_worktool endpoint to known, trusted IP addresses using a reverse proxy or Web Application Firewall (WAF).
  • Audit all incoming webhook traffic for anomalous payloads targeting internal internal service URLs.
  • Upgrade xiaobei to a version released after 5.5.2 that implements cryptographic signature validation for webhook requests (CVE-2026-85667).
]]>criticaladvisorywebservervulnerabilitycve