emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.

Affected: Go: github.com/jm33-m0/emp3r0r/core

### Summary The `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing.

### Details The plain HTTP C2 server starts the HTTP polling listener and forwards requests into `HandleHTTPServerSession`: ```go // core/internal/cc/server/c2_http_server.go mux.HandleFunc(c2Path, func(w http.ResponseWriter, req *http.Request) { stream, err := transport.HandleHTTPServerSession(w, req, &live.RuntimeConfig.MalleableC2) ... if stream != nil { go cborStreamAccept(transport.NewStreamTransport(stream, req.RemoteAddr)) } }) ``` The HTTP polling handler accepts an attacker-supplied `sessionID` and `init=1` cookie, then creates and stores a server-side stream before authentication:

```go // core/internal/transport/c2channel_http.go if isInit { stream = newHTTPServerStream(sessionID) w.WriteHeader(http.StatusOK) return stream, nil } ``` POST bodies for that unauthenticated session are read and queued before CBOR authentication rejects them: ```go // core/internal/transport/c2channel_http.go case http.MethodPost: data, err := io.ReadAll(req.Body) if err == nil && len(data) > 0 { select { case stream.readCh <- data: w.WriteHeader(http.StatusOK)…