NousResearch Hermes SimpleX Gateway Authorization Bypass via Colliding Display Name (CWE-284)

Vulnerability Overview Title: Hermes SimpleX sender allowlist can be bypassed via colliding display name on upstream main #44729 Description: Hermes upstream main contains an authorization bypass vulnerability in the SimpleX gateway path. When is configured using contact display names, different SimpleX contacts can set the same display name, even if their stable authentication does not match. This allows unauthorized remote SimpleX contacts to bypass the gateway authorization boundary and reach the agent execution path. Scope Affected Products: - Ecosystem: git - Package Name: NousResearch/hermes-agent - Affected versions: Unreleased upstream versions from to on the branch (currently, no package versions containing the vulnerable code have been released). Severity: - Severity: Medium - Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Weakness: - CWE: CWE-284: Improper Access Control Remediation Fixed Version: - Fixed Version: Unreleased Fix Details: - Commit removes the variable display name check in the SimpleX allowlist. POC Code Log Evidence Context Permalink: - - Description: - The SimpleX adapter reads mutable contact display metadata and stores it as . - The adapter constructs a containing the stable and the mutable . - The SimpleX-specific authorization branch adds to check against , allowing a mutable display name to satisfy the exact stable sender identity required by . Summary This vulnerability allows unauthorized SimpleX contacts to bypass gateway authorization by setting a display name identical to that of an authorized contact. The remediation involves removing the check for variable display names, ensuring that only the stable is used for authorization.

Goal Reached Thanks to every supporter — we hit 100%!

NousResearch Hermes SimpleX Gateway Authorization Bypass via Colliding Display Name (CWE-284)

More from this source