Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in the Hermes WebUI that allows unauthenticated remote attackers to hijack the initial setup process. This could enable an attacker to set an arbitrary password, gain session access, and lock out legitimate operators from their own instance. The main concern is confirming relevance and exposure to business operations.
- Attackers can reset passwords during setup.
- This compromises initial system access and control.
- Confirm relevance and exposure to operations.
Attack Path
How an attacker could exploit the issue
An attacker on any network can target the initial setup of Hermes WebUI by sending a special request to its settings API. This request can set an arbitrary password, allowing the attacker to gain access and lock out the legitimate user during the critical first-run configuration.
- Unauthenticated remote network access.
- Submitting _set_password parameter to settings API.
- Password takeover and legitimate user lockout.
Live Threat
Current exploitation, exposure, and threat context
During the initial setup phase, an unauthenticated attacker could exploit this vulnerability to hijack the system by submitting an arbitrary password hash to the settings API. This action could allow them to gain a valid session cookie and lock out the legitimate operator.
- System configuration and operator access.
- Unauthenticated API interaction during setup.
- Unauthorized control and operator lockout.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects the initial setup of Hermes WebUI, making it critical for teams managing this application to identify all instances, assess their reachability, and determine business criticality. The first practical step is to locate all deployments and confirm their ownership to plan a coordinated remediation.
- Application owners should manage the issue.
- Verify initial setup access controls first.
- Plan remediation based on exposure.
