mythic 0.3.0rc3

Direct Vulnerabilities

Known vulnerabilities in the mythic package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Missing Authorization mythic is an Interact with Mythic C2 Framework Instances Affected versions of this package are vulnerable to Missing Authorization in the `c2profile_config_check_webhook`, `c2profile_redirect_rules_webhook`, `c2profile_get_ioc_webhook`, and `c2profile_sample_message_webhook` endpoints due to missing verification of payload ownership. An attacker can gain unauthorized access to sensitive C2 profile configuration data, including encryption keys and callback parameters, by supplying a known payload UUID from another operation. How to fix Missing Authorization? A fix was pushed into the `master` branch but not yet published.	[0,)
H Incorrect Authorization mythic is an Interact with Mythic C2 Framework Instances Affected versions of this package are vulnerable to Incorrect Authorization due to a broken permission filter in the `payload_build_step` table, which uses an always-satisfied `_or` condition that bypasses operation-scoped access controls. An attacker can access sensitive information, including `step_stdout`, `step_stderr`, `step_name`, and `step_description` from all operations by sending crafted queries as an authenticated operator or spectator. How to fix Incorrect Authorization? A fix was pushed into the `master` branch but not yet published.	[0,)

Vulnerability

Vulnerable Version

Missing Authorization

mythic is an Interact with Mythic C2 Framework Instances

Affected versions of this package are vulnerable to Missing Authorization in the c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, and c2profile_sample_message_webhook endpoints due to missing verification of payload ownership. An attacker can gain unauthorized access to sensitive C2 profile configuration data, including encryption keys and callback parameters, by supplying a known payload UUID from another operation.

How to fix Missing Authorization?

A fix was pushed into the master branch but not yet published.

[0,)

Incorrect Authorization

mythic is an Interact with Mythic C2 Framework Instances

Affected versions of this package are vulnerable to Incorrect Authorization due to a broken permission filter in the payload_build_step table, which uses an always-satisfied _or condition that bypasses operation-scoped access controls. An attacker can access sensitive information, including step_stdout, step_stderr, step_name, and step_description from all operations by sending crafted queries as an authenticated operator or spectator.

How to fix Incorrect Authorization?

A fix was pushed into the master branch but not yet published.

[0,)

mythic@0.3.0rc3

Interact with Mythic C2 Framework Instances

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically