Description

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-02T18:19:59.973Z",
  "pubdate": "2026-09-02T18:19:59.973Z",
  "executiveSummary": "Joro versions prior to 1.1.1 are susceptible to a critical unauthenticated remote code execution vulnerability originating from an insecurely configured local API. The flaw stems from the default proxy mode, which binds an administrative interface to 127.0.0.1:9090 without implementing authentication controls.\nThe vulnerability is exacerbated by an overly permissive wildcard Cross-Origin Resource Sharing (CORS) policy. This configuration allows arbitrary malicious websites, visited by an authenticated operator, to perform cross-origin requests to the local API. Because the API facilitates sensitive operations such as plugin uploads—which utilize the CORS-safelisted multipart/form-data content type—an attacker can bypass preflight requirements and interact with privileged endpoints.\nSuccessful exploitation enables an attacker to remotely upload and execute arbitrary code on the operator's machine under their user context. The impact is total system compromise from the perspective of the application. Given that the API is exposed on the local loopback interface, the attack vector relies on the operator browsing to a malicious site while the Joro framework is running. No prior authentication or specialized privileges are required to initiate the attack sequence, making this a high-risk security flaw that necessitates immediate patching to version 1.1.1.",
  "technicalDetails": "The root cause of this vulnerability is the confluence of missing authentication on the local API (127.0.0.1:9090) and an unrestricted CORS policy in Joro versions prior to 1.1.1. By default, the framework exposes privileged administrative functions to the local network interface without verifying the identity of the requester.\nThe exploitation mechanism leverages the browser's ability to issue cross-origin requests to local services. While modern browsers employ CORS to restrict cross-origin access, Joro's implementation of a wildcard policy (* or equivalent permissive settings) instructs the browser to allow requests from any origin. Crucially, the plugin upload endpoint accepts the multipart/form-data content type. Under the CORS specification, simple requests—including those using multipart/form-data—do not always trigger a preflight OPTIONS request, or the permissive policy explicitly permits them, allowing the malicious script to bypass browser-side protections.\nThe attack flow follows a precise sequence: 1) The operator runs the Joro framework, initiating the vulnerable API server on port 9090. 2) The attacker lures the operator to a malicious web page hosting crafted JavaScript. 3) Upon loading, the JavaScript initiates an asynchronous POST request to http://127.0.0.1:9090/api/plugins/upload (or the equivalent target endpoint). 4) The payload, encapsulated as a multipart/form-data object, is sent directly through the operator’s browser to the local API. 5) The API processes the request, bypassing authentication checks, and stores the malicious plugin in the application directory. 6) The attacker issues a subsequent request to trigger a framework restart, forcing the application to load and execute the injected plugin. 7) The malicious code executes immediately upon restart, granting the attacker arbitrary code execution with the privileges of the system user running the Joro framework.\nThis vulnerability effectively transforms the operator's browser into a proxy for the attacker, providing a bypass for network-level restrictions. Because the malicious plugin executes on load, the persistence mechanism is automated, leading to complete and silent exploitation of the local system. The requirement of a single page visit from the operator makes this attack vector highly effective against users of the Joro web exploitation framework."
}