Halohub - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/halohub/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 19 Aug 2026 16:41:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in Halo via Plugin and Migration Vulnerabilitieshttps://feed.craftedsignal.io/briefs/2026-08-halo-rce-chain/Wed, 19 Aug 2026 16:41:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-halo-rce-chain/Halo versions up to 2.25.4 are vulnerable to RCE through insecure plugin installation and migration restoration processes, which can be chained with CSRF to allow unauthenticated attackers to compromise an instance if an administrator visits a malicious page.Researchers have disclosed a chain of vulnerabilities in the Halo CMS (up to version 2.25.4) that facilitates remote code execution (RCE). The primary vulnerability, CVE-2026-67919, stems from the plugin installation and upgrade feature, which fetches and executes arbitrary JAR files from a user-supplied URL without verifying the source or destination. This is compounded by CVE-2026-67920, an insecure migration restore function that allows attackers to overwrite system extension directories, and CVE-2026-67921, a CSRF/CORS vulnerability that allows an attacker to bypass authentication requirements. By tricking an authenticated administrator into visiting a malicious webpage, an attacker can trigger the plugin or migration primitives, leading to full server-side code execution. Given the availability of public proof-of-concept (PoC) code and the high CVSS score (9.8), organizations running Halo should prioritize patching or restricting access to the console until a fix is deployed.

Attack Chain

  1. Attacker constructs a malicious plugin JAR file containing arbitrary Java code and hosts it on an externally accessible web server.
  2. Attacker hosts a malicious webpage (CSRF/CORS trigger) that, when visited by an administrator, performs cross-origin fetch requests to the Halo instance console.
  3. The victim administrator, who is already authenticated to the Halo console, visits the attacker-controlled webpage.
  4. The browser automatically includes the victim's session cookies with the request to the Halo API due to permissive CORS settings and 'SameSite=None' cookies.
  5. The attacker-controlled JavaScript executes an 'install-from-uri' or 'upgrade-from-uri' call to the Halo Plugin Manager API, pointing to the malicious JAR hosted in step 1.
  6. The Halo server fetches the malicious JAR from the attacker's server and proceeds to load and execute the contained Java classes within the application runtime.
  7. The attacker's code runs with the privileges of the Halo application service, allowing for persistent backdoor installation or full system compromise.

Impact

Successful exploitation allows unauthenticated remote attackers to achieve full code execution on the server hosting the Halo instance. This leads to complete system compromise, including the potential for data exfiltration, system destruction via the migration restore mechanism (which wipes existing configurations), and lateral movement within the target environment.

Recommendation

  • Immediately restrict network access to the Halo administration console to trusted internal IP addresses only.
  • Audit all currently installed plugins in the Halo instance to ensure they match known, legitimate sources.
  • Monitor web server logs for suspicious POST requests to the /api/plugins/install-from-uri or /api/plugins/upgrade-from-uri endpoints, specifically those originating from external, unexpected hosts.
  • If a fix is not immediately available, use firewall or WAF rules to block access to the /api/plugins/ and /api/migration/ endpoints from external sources.
]]>criticaladvisory