A critical vulnerability in HKUDS OpenHarness allows unauthenticated remote attackers to manage plugin lifecycles, leading to potential arbitrary code execution or system compromise.

This flaw is classified as an incorrect default permissions issue (CWE-276), where sensitive plugin management commands are exposed to remote callers by default without sufficient authentication requirements. An attacker can leverage these commands to install or reload malicious plugins, effectively gaining control over the application environment.

The ability for an unauthorized party to install and enable arbitrary plugins presents a severe risk to organizational integrity and data security. With a CVSS score of 8.8, this vulnerability is categorized as High, as it provides a direct path for attackers to introduce malicious code into the system, potentially resulting in full system compromise, data exfiltration, or the establishment of persistent backdoors.

Immediate Action: Update the HKUDS OpenHarness software to the version containing the fix implemented in PR #156 or higher (v0.1.7).

Proactive Monitoring: Review application and system access logs for any unauthorized use of plugin management commands or unexpected plugin installation events.

Compensating Controls: Implement strict network access control lists to restrict traffic to the channel layer used by OpenHarness, ensuring only trusted internal components can communicate with the management interface.

Public Exploit Available: No

Given the severity of the impact and the ease with which plugin lifecycle commands can be abused, immediate action is required to secure the environment. Organizations currently running versions of HKUDS OpenHarness prior to PR #156 must prioritize the application of the vendor update to eliminate this unauthorized management vector and prevent potential exploitation.