An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.
Loading...
Loading...
Score 9.8 from GitHub Security Advisory (severity: CRITICAL) published 2024-08-12. NVD baseline CVSS 9.8; sources differ by 0.0.
An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.
August 12, 2024
August 29, 2024
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
Working exploit code is in the public domain (5 GitHub PoCs). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
Automated Reverse Shell Exploit via WebSocket | Havoc-C2-SSRF with RCE
Open source ↗This is a modified version of the CVE-2024-41570 SSRF PoC from @chebuya chained with the auth RCE exploit from @hyperreality. This exploit executes code remotely to a target due to multiple vulnerabilities in Havoc C2 Framework. (https://github.com/HavocFramework/Havoc)
Open source ↗Havoc SSRF to RCE
Open source ↗This is a Chained RCE in the Havoc C2 framework using github.com/chebuya and github.com/IncludeSecurity pocs
Open source ↗CVE-2024-41570: Havoc C2 0.7 Teamserver SSRF exploit
Open source ↗See which npm, PyPI, Go, and Maven packages are affected by CVE-2024-41570
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.
CWE-918