XWorm Path Traversal Bug Enables Remote Hijack of C2 Servers Without Authentication

An attacker who obtains the network details of an XWorm command-and-control panel can execute arbitrary code on the server without authentication. This capability allows threat actors to hijack the infrastructure used by malware operators, effectively turning the attackers' own tools against them. The flaw grants full control over the C2 host, enabling the compromise of the operator’s environment through a single remote request.

How it unfolded

• Independent researcher Mootoo discovered the vulnerability on October 4 while reverse-engineering an XWorm sample used in an attack against them.
• Mootoo published a proof-of-concept exploit demonstrating how an attacker can overwrite a DLL using path traversal to achieve remote code execution.
• The researcher successfully used the flaw to compromise infrastructure tied to the individual behind the initial attack attempt.

Who is affected

Organizations running XWorm command-and-control panels in versions up to 7.4 are vulnerable to this unauthenticated remote code execution flaw. According to SecurityWeek, the researcher noted that the vulnerability appears to be exploited on a limited scale in the wild. Any entity operating these specific versions of the malware infrastructure faces the risk of having their C2 servers taken over by remote adversaries who possess the necessary connection parameters.

The fix

No official patch or security update has been confirmed by the vendor to address this specific remote code execution vulnerability. Users of XWorm versions up to 7.4 should assume their command-and-control infrastructure remains exposed to takeover if the panel address and keys are leaked. Until a fix is released, operators must treat their C2 endpoints as compromised if network details have been exposed to potential adversaries.

What made it possible

This incident highlights the risks of insufficient input validation in server-side components. When applications fail to sanitize file paths, attackers can traverse directories to modify critical system files. This technique often serves as a pivot point during intrusions, allowing remote actors to gain persistent access. Teams usually review how services handle file uploads and path requests to prevent unauthorized modifications. Checking whether services restrict write access to sensitive directories is a standard defensive measure against such traversal attacks.

Background: Proof-of-concept exploits

Proof-of-concept exploits demonstrate that a vulnerability is exploitable in a real environment. They help you move beyond theoretical severity scores to understand actual impact. This evidence drives faster, more accurate patching decisions and prevents waste on low-risk issues.

Read the full guide: Why Proof-of-Concept Exploits Define Your Security Response

What to do and how to stay safe

• Audit all command-and-control infrastructure for exposed configuration files containing network keys or addresses.
• Monitor server logs for unusual file modification attempts or unexpected DLL overwrites on C2 hosts.
• Restrict network access to management panels to trusted IP ranges where operationally feasible.
• Rotate all communication keys and credentials immediately if there is any suspicion of exposure.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of XWorm are affected by this flaw?

Versions up to 7.4 of the XWorm RAT’s C2 panel are vulnerable to this unauthenticated remote code execution issue.