HexStrike AI vulnerabilities

A security vulnerability has been detected in 0x4m4 HexStrike AI in the FileOperationsManager function of hexstrike_server.py (API Files Endpoint component). Manipulation of the filename argument leads to path traversal. The attack may be initiated remotely and the exploit has been publicly disclosed.

A weakness has been identified in 0x4m4 HexStrike AI in the subprocess.Popen function of hexstrike_server.py (API Tools Endpoint component). Manipulation of the additional_args/target/username/password/scan_type/payload arguments can lead to OS command injection. The attack can be launched remotely and the exploit has been made available to the public.

A missing authentication vulnerability was determined in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (API Command Endpoint component). The manipulation causes missing authentication. The attack can be initiated remotely and the exploit has been publicly disclosed. The product uses rolling releases, so no version details are available.

An OS command injection vulnerability was found in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (Execute Endpoint component). Manipulating the code/script argument leads to command injection. The attack is possible remotely and the exploit has been disclosed publicly. The product uses rolling releases, so no version details are available.