A critical vulnerability in the Joro web exploitation framework allows unauthenticated attackers to achieve remote code execution through the operator's browser session.

The application exposes a local API on port 9090 that lacks authentication and implements a permissive CORS policy. This allows a remote attacker to force the user's browser to upload and execute malicious plugins without user interaction or preflight checks.

The vulnerability carries a CVSS score of 9.6, reflecting the severity of full system compromise. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the operator, leading to potential data exfiltration, lateral movement, or complete loss of control over the affected workstation.

Immediate Action: Update BishopFox joro to version 1.1.1 or later immediately to resolve the authentication and CORS configuration flaws.

Proactive Monitoring: Review browser activity and network logs for unauthorized requests originating from or directed toward localhost:9090.

Compensating Controls: Ensure that browser security settings are strictly configured and utilize network-level controls to restrict access to the local API port if an immediate update is not feasible.

Public Exploit Available: Unknown

Given the critical nature of this flaw and the potential for full remote code execution, organizations must prioritize updating Joro to version 1.1.1. Failure to patch leaves the operator's environment exposed to silent, browser-based attacks that bypass traditional perimeter defenses.