A critical remote code execution vulnerability in Halo version 2.25.4 permits unauthenticated attackers to execute arbitrary code through malicious plugin installation.

The vulnerability resides in the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components. An unauthenticated attacker can leverage these components to install malicious plugins, resulting in arbitrary code execution.

With a CVSS score of 9.8, this vulnerability represents an extreme risk to the availability and security of the Halo platform. Successful exploitation grants an attacker full control over the application environment, facilitating potential data theft, service disruption, and lateral movement within the network.

Immediate Action: Upgrade your Halo installation to a version beyond 2.25.4 immediately as indicated by the vendor advisory.

Proactive Monitoring: Audit installed plugins for unauthorized or suspicious additions, and review server logs for unusual HTTP requests targeting the plugin installation endpoints.

Compensating Controls: Restrict access to administrative and plugin management interfaces to authorized internal networks only, and ensure that the application is running with the minimum necessary system privileges.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

This vulnerability is critical and requires immediate patching. Administrators must ensure their Halo instance is updated to a version beyond 2.25.4 and verify that no unauthorized plugins have been installed during the period of exposure.