Skip to content

v2.2.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 02:20
v2.2.2
This tag was signed with the committer’s verified signature.
Ne0nd0g Russel Van Tuyl
GPG key ID: E9E25562F74A7B46
Verified
Learn about vigilant mode.
93d6898
This commit was signed with the committer’s verified signature.
Ne0nd0g Russel Van Tuyl
GPG key ID: E9E25562F74A7B46
Verified
Learn about vigilant mode.

Merlin Server v2.2.2

Security release — fixes an authenticated operator → teamserver remote code execution in the SharpGen module. Upgrading is recommended for anyone running a Merlin teamserver.

Security

GHSA-gmq6-43v4-9vrv — SharpGen operator-to-server RCE

The SharpGen module passed the operator-supplied dotnetbin and sharpgenbin options straight into exec.Command() after only checking that the files existed — not that they were the expected executables. An authenticated operator could set dotnetbin=/bin/bash and sharpgenbin=<a file downloaded to the server> and execute arbitrary commands on the teamserver, frequently as root.

  • Severity: Low (requires an authenticated operator)
  • Affected: Merlin Server ≤ 2.2.1
  • Fixed in: 2.2.2
  • Reported by @lesteratSOL — thank you for the responsible disclosure.

Changes

Fixed

  • Pin the dotnet executable and the SharpGen compiler DLL to fixed, server-side locations so an operator can no longer choose which binary the server runs. Compiling arbitrary C# still works — that input is compiler data, never executed on the server.

Changed

  • Removed the now-inert dotnetbin and sharpgenbin options from the SharpGen module (both the module definition and the RPC handler).

Added

  • New -dotnetBin server flag to configure the path to the dotnet executable (default dotnet, resolved from PATH). This is a server-launch setting — chosen by whoever runs the teamserver, not an operator-controllable option — so it restores install-location flexibility without reopening the vulnerability.

Upgrade notes

  • Server-only release. The Merlin Agent and Merlin CLI are unaffected and do not need updating for this fix.
  • If you previously pointed the SharpGen module at a dotnet outside your PATH (e.g. installed via dotnet-install.sh to ~/.dotnet), set it at launch instead: 
    ./merlinServer -dotnetBin /path/to/dotnet ...
  • The SharpGen compiler DLL is now always loaded from data/src/cobbr/SharpGen/bin/release/netcoreapp2.1/SharpGen.dll under the Merlin root (the standard submodule build location).

The data/bin directory contains compiled versions of the Merlin CLI and Merlin Agents

Merlin documentation and Wiki can be found here

The compressed files have a password of merlin

Assets 8
Loading