Description

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T23:16:52.240Z",
  "pubdate": "2026-08-17T23:16:52.240Z",
  "executiveSummary": "An unauthenticated remote code execution vulnerability has been identified in version 2.25.4 of the Halo platform. The security flaw exists within the plugin installation subsystem, specifically involving the PluginEndpoint.java controller, the installFromUri method, and the DefaultPluginApplicationContextFactory components.\nThe vulnerability allows a remote, unauthenticated attacker to supply a malicious plugin Uniform Resource Identifier (URI) that the application automatically fetches, processes, and installs. Successful exploitation results in arbitrary code execution on the underlying host operating system with the privileges of the running Java application server.\nThis introduces severe risk implications, including complete system compromise, unauthorized data exfiltration, and potential lateral movement within the affected network. Attackers require network access to the application endpoint exposed by the plugin management interface to trigger the flaw. Mitigation requires restricting access to vulnerable administrative endpoints and applying official vendor patches as soon as they become available.",
  "technicalDetails": "The vulnerability resides within the plugin management architecture of Halo version 2.25.4. Specifically, the flaw stems from insecure input handling and lack of strict provenance validation within the PluginEndpoint.java class, the installFromUri method, and the underlying DefaultPluginApplicationContextFactory component.\nThe root cause is the application's unvalidated processing of externally supplied URIs during the plugin installation lifecycle. When a remote attacker interacts with the exposed endpoint, the application initiates an outbound fetch operation to retrieve the resource referenced by the provided URI. Because the application fails to adequately sanitize or restrict the destination and content type of the retrieved package, it ingests malicious payloads disguised as valid application plugins.\nThe attack flow proceeds as follows: First, the remote attacker crafts a malicious plugin archive containing executable code or serialized objects designed to trigger arbitrary execution upon instantiation. Second, the attacker transmits an HTTP request targeting the installFromUri method within PluginEndpoint.java, passing the URI pointing to the externally hosted malicious payload. Third, the application attempts to fetch and parse the resource. Finally, the DefaultPluginApplicationContextFactory initializes the plugin context, causing the embedded malicious bytecode to execute within the Java Virtual Machine (JVM).\nNetwork exposure is defined by the accessibility of the web interface exposing the plugin management API. Authentication requirements depend on default configurations, but the parameter handling flaws in the affected components facilitate remote exploitation. Post-exploitation impact includes full control over the application runtime environment, access to sensitive database credentials, and the potential to execute system-level commands on the host infrastructure."
}