BC-SECURITY/Empire

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-tag.yml line 28
Likely real: Yes, 99% confidence

A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it.

run: |
          curl -sL https://install.python-poetry.org | python - -y

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-start.yml line 41
Likely real: Yes, 99% confidence

A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it.

run: |
          curl -sL https://install.python-poetry.org | python - -y

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 187
Likely real: Yes, 99% confidence

A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it.

run: |
          curl -sL https://install.python-poetry.org | python - -y

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 135
Likely real: Yes, 99% confidence

A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it.

run: |
          curl -sL https://install.python-poetry.org | python - -y

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 40
Likely real: Yes, 99% confidence

A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it.

run: |
          curl -sL https://install.python-poetry.org | python - -y

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/core/go.py line 79
Likely real: Yes, 97% confidence

Using jinja2 templates with autoescape=False is dangerous and can lead to XSS. Use autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities.

78         self.install_path = install_path
79         self.jinja_env = jinja2.Environment(
80             loader=jinja2.FileSystemLoader(
81                 str(self.install_path / "data/agent/gopire")
82             ),
83             autoescape=False,  # noqa: S701 - renders attack payloads/scripts, not HTML; autoescaping would corrupt output
84         )
85         self._go_binary = _resolve_go_binary()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/actions/clean-merge/action.yml line 26
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
        git merge --no-edit ${{ inputs.from-branch }}
        if [ $? -ne 0 ]; then
          echo "Merge failed. Aborting. This is likely caused by a conflict and the merge must be done manually."
          exit 1
        fi

        git diff ${{ inputs.push-repo }}/${{ inputs.to-branch }} --exit-code --quiet
        if [ $? -eq 0 ]; then
          echo "No changes needed to merge."
          echo "MERGE_STATUS=NO_CHANGES" >> $GITHUB_ENV
        else
          echo "Changes needed to merge."
          echo "MERGE_STATUS=CHANGES" >> $GITHUB_ENV
        fi
        exit 0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/actions/clean-merge/action.yml line 19
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
        git checkout ${{ inputs.to-branch }}

        git clean -xfd
        git reset --hard

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-tag.yml line 15
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
          echo "TAG_NAME=$(echo ${{ github.head_ref }} | sed 's/release\///')" >> $GITHUB_ENV

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-start.yml line 16
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
          echo "TARGET_BRANCH=sponsors-main" >> $GITHUB_ENV
          echo "STARKILLER_TAG=${{ github.event.inputs.starkillerVersion }}-sponsors" >> $GITHUB_ENV

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-start.yml line 44
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
          OLD_VERSION=$(poetry version -s)
          if [ -n "${{ github.event.inputs.overrideVersion }}" ]; then
            poetry version ${{ github.event.inputs.overrideVersion }}
          else
            poetry version ${{ github.event.inputs.bumpType }}
          fi
          APP_VERSION=$(poetry version -s)
          echo "APP_VERSION=$(poetry version -s)" >> $GITHUB_ENV
          sed -i "s/$OLD_VERSION\ BC\ Security/$APP_VERSION\ BC\ Security/" empire/server/common/empire.py

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/cherry-pick-main.yml line 48
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
          echo "COMMIT_HASH=${{ github.event.inputs.commitHash }}" >> $GITHUB_ENV

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/actions/update-starkiller/action.yml line 36
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
        git add -A
        git commit --message "Update starkiller version to ${{ inputs.starkiller-version }}"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/actions/update-starkiller/action.yml line 32
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
        sed -i '/## \[${{ inputs.app-version }}\]/a -   Updated Starkiller to ${{ inputs.starkiller-version }}' ${{ inputs.changelog-path }}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/actions/update-starkiller/action.yml line 28
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
        yq -i '.starkiller.ref = "${{ inputs.starkiller-version }}"' empire/server/config.yaml

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/actions/update-starkiller/action.yml line 24
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
        yq -i '.starkiller.repo = "${{ inputs.repo }}"' empire/server/config.yaml

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/actions/clean-merge/action.yml line 45
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: |
        git push ${{ inputs.push-repo }} ${{ inputs.to-branch }}
        echo "MERGE_STATUS=NO_CHANGES" >> $GITHUB_ENV

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/obfuscation_service.py line 133
Likely real: Yes, 55% confidence

Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

shell=True,

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/base.py line 70
Likely real: Yes, 55% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

connection.execute(text(cmd))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/alembic/versions/0007_tags_as_labels.py line 99
Likely real: Yes, 55% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

text(f"UPDATE tags SET name = {fold_expr}, value = '' WHERE value <> ''")  # noqa: S608

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/base.py line 414
Likely real: Yes, 55% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

text(
                        f"""
                    SELECT * FROM information_schema.COLUMNS
                    WHERE TABLE_SCHEMA = '{database_name}'
                    AND table_name = 'hosts'
                    AND column_name = 'unique_check'
                    """
                    )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/alembic/versions/0007_tags_as_labels.py line 122
Likely real: Yes, 54% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

text(f"UPDATE {tbl} SET tag_id = :s WHERE tag_id = :d"),  # noqa: S608

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/base.py line 97
Likely real: Yes, 54% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

connection.execute(text(f"CREATE DATABASE IF NOT EXISTS {database_name}"))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/alembic/versions/0007_tags_as_labels.py line 156
Likely real: Yes, 54% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

text(f"INSERT INTO {tbl} ({col_list}) VALUES ({placeholders})"),  # noqa: S608

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/alembic/versions/0007_tags_as_labels.py line 154
Likely real: Yes, 54% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

bind.execute(text(f"DELETE FROM {tbl}"))  # noqa: S608

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/db/alembic/versions/0007_tags_as_labels.py line 149
Likely real: Yes, 54% confidence

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.

rows = bind.execute(text(f"SELECT {col_list} FROM {tbl}")).all()  # noqa: S608

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 865
Likely real: Yes, 54% confidence

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

ps = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/privesc/linuxprivchecker.py line 27
Likely real: Yes, 53% confidence

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

[cmd], stdout=sub.PIPE, stderr=sub.PIPE, shell=True

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/modules/python/privesc/multi/CVE-2021-4034.py line 39
Likely real: Yes, 53% confidence

Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

output = subprocess.check_output(command, shell=True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/stagers/windows/cmd_exec.py line 146
Likely real: Yes, 53% confidence

Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

return subprocess.check_output(msf_command, shell=True)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 794
Likely real: Yes, 53% confidence

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

shell=True,

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/config/data_manager.py line 297
Likely real: Uncertain, 47% confidence

Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker

tarfile.open(fileobj=resp.raw, mode="r|gz") as tar,
        ):
            # filter="data" guards against path traversal in the downloaded archive.
            tar.extractall(compiler_dir, filter="data")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/plugin_service.py line 314
Likely real: Uncertain, 47% confidence

Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker

tarfile.open(fileobj=fileobj, mode="r|*") as tar,
                ):
                    # filter="data" guards against path traversal in the plugin archive.
                    tar.extractall(path=temp_dir, filter="data")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/plugin_service.py line 329
Likely real: Uncertain, 47% confidence

Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker

with tarfile.open(fileobj=response.raw, mode="r|*") as tar:
            # filter="data" guards against path traversal in the plugin archive.
            tar.extractall(path=temp_dir, filter="data")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/gopire/agent/agent.go line 99
Likely real: Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

cmd := exec.Command(command, cmdargs...)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/gopire/common/utils.go line 19
Likely real: Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

cmd = exec.Command("sh", "-c", command)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/common/templating.py line 20
Likely real: Uncertain, 42% confidence

By default, jinja2 sets autoescape to False. Consider using autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities.

19         """
20         env = jinja2.Environment(  # noqa: S701 - renders attack payloads/scripts, not HTML; autoescaping would corrupt output
21             loader=jinja2.FileSystemLoader(path),
22             comment_start_string='"""',
23             comment_end_string='"""',
24             line_comment_prefix="#",
25         )
26

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/privesc/linuxprivchecker.py line 31
Likely real: Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.

30         else:  # older version of python, use os.popen
31             echo_stdout = os.popen(cmd, "r")
32             results = echo_stdout.read().split("\n")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/stagers/windows/cmd_exec.py line 146
Likely real: Uncertain, 33% confidence

subprocess call with shell=True identified, security issue.

145         print(f"[*] MSF command -> {msf_command}")
146         return subprocess.check_output(msf_command, shell=True)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 794
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

793             stderr=subprocess.STDOUT,
794             shell=True,
795         )
796         # errors="replace" tolerates non-UTF8 console output (e.g. CP1252 on Windows).
797         return p.communicate()[0].strip().decode("utf-8", errors="replace")
798 
799     def get_file_part(self, filePath, offset=0, chunkSize=512000, base64=True):
800         if not os.path.exists(filePath):
801             return ""

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/privesc/linuxprivchecker.py line 27
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

26             out, error = sub.Popen(
27                 [cmd], stdout=sub.PIPE, stderr=sub.PIPE, shell=True
28             ).communicate()
29             results = out.decode().split("\n")
30         else:  # older version of python, use os.popen

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/core/obfuscation_service.py line 133
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

132                     f'{data_util.get_powershell_name()} -C \'$ErrorActionPreference = "SilentlyContinue";Import-Module {install_path}/data/Invoke-Obfuscation/Invoke-Obfuscation.psd1;Invoke-Obfuscation -ScriptPath {toObfuscateFile.name} -Command "{self._convert_obfuscation_command(obfuscation_command)}" -Quiet | Out-File -Encoding ASCII {obfuscatedFile.name}\'',
133                     shell=True,
134                     timeout=timeout,
135                     check=False,
136                     start_new_session=True,
137                     capture_output=True,
138                 )
139             except subprocess.TimeoutExpired:
140                 log.exception(
141                     "Obfuscation subprocess timed out after %ds. "

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 865
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

864         cmd = 'ps %s' % (os.getpid())
865         ps = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
866         out, err = ps.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/modules/python/privesc/multi/CVE-2021-4034.py line 39
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

38         command = f"msfvenom -p linux/x64/exec CMD='{launcher}' -f elf-so PrependSetuid=true | base64"
39         output = subprocess.check_output(command, shell=True)
40         output = output.replace(b"\n", b"")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Dockerfile line 103
Likely real: Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

CMD ["-f", "server"]

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Dockerfile line 102
Likely real: Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

ENTRYPOINT ["./ps-empire"]

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/docker-compose.yml line 5
Likely real: Yes, 100% confidence

Service 'test' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

test:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 10
Likely real: Yes, 100% confidence

Service 'ubuntu2204' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

ubuntu2204:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 17
Likely real: Yes, 100% confidence

Service 'ubuntu2404' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

ubuntu2404:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 24
Likely real: Yes, 100% confidence

Service 'debian12' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

debian12:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 31
Likely real: Yes, 100% confidence

Service 'debian13' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

debian13:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 45
Likely real: Yes, 100% confidence

Service 'parrotrolling' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

parrotrolling:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 38
Likely real: Yes, 100% confidence

Service 'kalirolling' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

kalirolling:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/docker-compose.yml line 27
Likely real: Yes, 100% confidence

Service 'db' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

db:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/api/jwt_auth.py line 109
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret "Failed to generate password hash. Verify that OpenSSL supports %s " "and that os.urandom is available." being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

log.exception(
            "Failed to generate password hash. Verify that OpenSSL supports %s "
            "and that os.urandom is available.",
            PBKDF2_HASH_ALGO,
        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/agent_communication_service.py line 115
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret "credential parser %s raised on task output" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

log.exception(
                "credential parser %s raised on task output",
                parser.__class__.__name__,
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/agent_communication_service.py line 122
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret "credential parser %s returned %s; expected list — skipping" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

log.error(
                "credential parser %s returned %s; expected list — skipping",
                parser.__class__.__name__,
                type(parsed).__name__,
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/agent_communication_service.py line 140
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret "credential_service raised persisting %s row for %s — " "aborting remainder of this batch" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

log.exception(
                    "credential_service raised persisting %s row for %s — "
                    "aborting remainder of this batch",
                    req.credtype,
                    req.username,
                )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/core/agent_communication_service.py line 148
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret "credential_service.create_credential rejected %s row: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

log.warning(
                    "credential_service.create_credential rejected %s row: %s",
                    req.credtype,
                    err,
                )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 45
Likely real: Yes, 100% confidence

Service 'parrotrolling' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

parrotrolling:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/misc/apptemplateResources/x64/launcher.app/Contents/Info.plist line 3
Likely real: Yes, 100% confidence

The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface.

<plist version="1.0">
<dict>
	<key>BuildMachineOSBuild</key>
	<string>15G31</string>
	<key>CFBundleDevelopmentRegion</key>
	<string>en</string>
	<key>CFBundleExecutable</key>
	<string>launcher</string>
	<key>CFBundleIdentifier</key>
	<string>com.apple.launcher</string>
	<key>CFBundleInfoDictionaryVersion</key>
	<string>6.0</string>
	<key>CFBundleName</key>
	<string>launcher</string>
	<key>CFBundlePackageType</key>
	<string>APPL</string>
	<key>CFBundleShortVersionString</key>
	<string>1.0</string>
	<key>CFBundleSignature</key>
	<string>????</string>
	<key>CFBundleSupportedPlatforms</key>
	<array>
		<string>MacOSX</string>
	</array>
	<key>CFBundleVersion</key>
	<string>1</string>
	<key>DTCompiler</key>
	<string>com.apple.compilers.llvm.clang.1_0</string>
	<key>DTPlatformBuild</key>
	<string>7D1014</string>
	<key>DTPlatformVersion</key>
	<string>GM</string>
	<key>DTSDKBuild</key>
	<string>15E60</string>
	<key>DTSDKName</key>
	<string>macosx10.11</string>
	<key>DTXcode</key>
	<string>0731</string>
	<key>DTXcodeBuild</key>
	<string>7D1014</string>
	<key>LSMinimumSystemVersion</key>
	<string>10.11</string>
	<key>LSUIElement</key>
	<true/>
	<key>NSHumanReadableCopyright</key>
	<string>Copyright © 2016 Apple. All rights reserved.</string>
	<key>NSMainNibFile</key>
	<string>MainMenu</string>
	<key>NSPrincipalClass</key>
	<string>NSApplication</string>
</dict>
</plist>

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/misc/apptemplateResources/x86/launcher.app/Contents/Info.plist line 3
Likely real: Yes, 100% confidence

The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface.

<plist version="1.0">
<dict>
	<key>BuildMachineOSBuild</key>
	<string>15G31</string>
	<key>CFBundleDevelopmentRegion</key>
	<string>en</string>
	<key>CFBundleExecutable</key>
	<string>launcher</string>
	<key>CFBundleIdentifier</key>
	<string>com.apple.launcher</string>
	<key>CFBundleInfoDictionaryVersion</key>
	<string>6.0</string>
	<key>CFBundleName</key>
	<string>launcher</string>
	<key>CFBundlePackageType</key>
	<string>APPL</string>
	<key>CFBundleShortVersionString</key>
	<string>1.0</string>
	<key>CFBundleSignature</key>
	<string>????</string>
	<key>CFBundleSupportedPlatforms</key>
	<array>
		<string>MacOSX</string>
	</array>
	<key>CFBundleVersion</key>
	<string>1</string>
	<key>DTCompiler</key>
	<string>com.apple.compilers.llvm.clang.1_0</string>
	<key>DTPlatformBuild</key>
	<string>7D1014</string>
	<key>DTPlatformVersion</key>
	<string>GM</string>
	<key>DTSDKBuild</key>
	<string>15E60</string>
	<key>DTSDKName</key>
	<string>macosx10.11</string>
	<key>DTXcode</key>
	<string>0731</string>
	<key>DTXcodeBuild</key>
	<string>7D1014</string>
	<key>LSMinimumSystemVersion</key>
	<string>10.11</string>
	<key>LSUIElement</key>
	<true/>
	<key>NSHumanReadableCopyright</key>
	<string>Copyright © 2016 Apple. All rights reserved.</string>
	<key>NSMainNibFile</key>
	<string>MainMenu</string>
	<key>NSPrincipalClass</key>
	<string>NSApplication</string>
</dict>
</plist>

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/management/socks.py line 452
Likely real: Yes, 100% confidence

'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.

s = ssl.wrap_socket(s)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/privesc/CVE-2021-4034.py line 47
Likely real: Yes, 100% confidence

These permissions `0o0755` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.

os.chmod('payload.so', 0o0755)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/privesc/CVE-2021-4034.py line 65
Likely real: Yes, 100% confidence

These permissions `0o0755` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.

os.chmod('GCONV_PATH=./exploit', 0o0755)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/docker-compose.yml line 5
Likely real: Yes, 99% confidence

Service 'test' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

test:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 10
Likely real: Yes, 99% confidence

Service 'ubuntu2204' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

ubuntu2204:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 17
Likely real: Yes, 99% confidence

Service 'ubuntu2404' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

ubuntu2404:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 24
Likely real: Yes, 99% confidence

Service 'debian12' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

debian12:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 31
Likely real: Yes, 99% confidence

Service 'debian13' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

debian13:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/docker-compose-install-tests.yml line 38
Likely real: Yes, 99% confidence

Service 'kalirolling' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

kalirolling:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/docker-compose.yml line 27
Likely real: Yes, 99% confidence

Service 'db' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

db:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/install_tests/InstallTest.Dockerfile line 18
Likely real: Yes, 99% confidence

Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities.

RUN ssh-keyscan -H github.com | sudo tee -a /etc/ssh/ssh_known_hosts > /dev/null

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/dependabot.yml line 3
Likely real: Yes, 99% confidence

This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

- package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    target-branch: "private-main"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/utils/listener_template_util.py line 64
Likely real: Yes, 98% confidence

Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().

63     """
64     raw = yaml.load(Path(path).read_text(), Loader=Loader)
65

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/core/module_service.py line 940
Likely real: Yes, 98% confidence

Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().

939         if modified_module.language == LanguageEnum.csharp:
940             compiler_dict = yaml.load(modified_module.compiler_yaml, Loader=Loader)
941             compiler_dict[0]["Code"] = modified_input

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/core/module_service.py line 962
Likely real: Yes, 98% confidence

Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().

961             try:
962                 yaml2 = yaml.load(file_path.read_text(), Loader=Loader)
963                 yaml_module = {k: v for k, v in yaml2.items() if v is not None}

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/privesc/CVE-2021-4034.py line 65
Likely real: Yes, 97% confidence

Chmod setting a permissive mask 0o755 on file (GCONV_PATH=./exploit).

64     exit()
65 os.chmod('GCONV_PATH=./exploit', 0o0755)
66

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/privesc/CVE-2021-4034.py line 47
Likely real: Yes, 97% confidence

Chmod setting a permissive mask 0o755 on file (payload.so).

46     exit()
47 os.chmod('payload.so', 0o0755)
48

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 1100
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(
                            packets.build_routing_packet(
                                stagingKey, sessionID, language, encData=encryptedAgent
                            ),
                            200,
                        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 764
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 1120
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(results, 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 1118
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 1113
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 1030
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 1023
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 993
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(results, 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 987
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 986
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 401)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 974
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(stage, 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 973
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 933
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(stage, 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 932
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 896
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 890
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 200)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 876
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 775
Likely real: Yes, 83% confidence

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

return make_response(self.default_response(), 404)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http_malleable/listener.py line 1947
Likely real: Yes, 80% confidence

The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.

context.set_ciphers(listener_util.generate_random_cipher())

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/listeners/http/listener.py line 1138
Likely real: Yes, 80% confidence

The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.

context.set_ciphers(listener_util.generate_random_cipher())

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 55% confidence

Unpinned dependency: 'pysecretsocks' has no version lock — supply chain risk

pysecretsocks = {'git': 'https://github.com/BC-SECURITY/PySecretSOCKS.git', 'rev': 'da5be0e'}

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 55% confidence

Unpinned dependency: 'donut-shellcode' has no version lock — supply chain risk

donut-shellcode = {'git': 'https://github.com/BC-SECURITY/donut.git', 'rev': 'b361c0d3'}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /setup/install.sh line 155
Likely real: Yes, 54% confidence

Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.

curl https://pyenv.run | bash

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/code_execution/invoke_script.py line 8
Likely real: Yes, 52% confidence

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

with urllib.request.urlopen(script_url) as response:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-tag.yml line 15
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 190
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 222
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 244
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: plexsystems/container-structure-test-action@v0.3.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 267
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 285
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: tj-actions/changed-files@v47.0.6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/prerelease-sponsor-kali-merge-private.yml line 38
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-start.yml line 27
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-start.yml line 37
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-start.yml line 60
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: vinnybod/keep-a-changelog-new-release@1.4.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-start.yml line 73
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: thomaseizinger/create-pull-request@1.4.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 138
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-tag.yml line 24
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-tag.yml line 35
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: vinnybod/extract-release-notes@v2

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-private-tag.yml line 38
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/create-release@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-public-start.yml line 58
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: thomaseizinger/create-pull-request@1.4.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-public-tag.yml line 15
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 12
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: pre-commit/action@v3.0.1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/dockerimage.yml line 18
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: docker/setup-buildx-action@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/dockerimage.yml line 16
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: docker/setup-qemu-action@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/dockerimage.yml line 14
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/cherry-pick-main.yml line 63
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: thomaseizinger/create-pull-request@1.4.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/cherry-pick-main.yml line 28
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/dockerimage.yml line 20
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: docker/login-action@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/dockerimage.yml line 37
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: docker/build-push-action@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 11
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 185
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 38
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 45
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 74
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/cache@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 119
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: MishaKav/pytest-coverage-comment@v1.11.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 133
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-public-start.yml line 20
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint-and-test.yml line 158
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/cache@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-public-tag.yml line 40
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/create-release@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-tag.yml line 35
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/create-release@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-tag.yml line 30
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: vinnybod/extract-release-notes@v2

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-tag.yml line 27
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: vinnybod/extract-release-notes@v2

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-tag.yml line 18
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-start.yml line 60
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: thomaseizinger/create-pull-request@1.4.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-public-tag.yml line 35
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: vinnybod/extract-release-notes@v2

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-start.yml line 20
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-sponsor-kali-start.yml line 34
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: vinnybod/keep-a-changelog-new-release@1.4.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/ironpython_agent.py line 1057
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(code_obj, exec_globals)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/ironpython_agent.py line 126
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(code, mod.__dict__)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 111
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(code, mod.__dict__)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 628
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(code_obj, exec_globals)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 655
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(code_obj, exec_globals)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/agent.py line 696
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(data, script_globals)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/ironpython_agent.py line 1031
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(code_obj, exec_globals)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/agent/ironpython_agent.py line 1200
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(data, script_globals)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/data/module_source/python/code_execution/invoke_script.py line 27
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(script_content, script_globals)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /empire/server/common/templating.py line 20
Likely real: Uncertain, 49% confidence