Merlin Server v2.2.2

Security release — fixes an authenticated operator → teamserver remote code execution in the SharpGen module. Upgrading is recommended for anyone running a Merlin teamserver.

Security

GHSA-gmq6-43v4-9vrv — SharpGen operator-to-server RCE

The SharpGen module passed the operator-supplied dotnetbin and sharpgenbin options straight into exec.Command() after only checking that the files existed — not that they were the expected executables. An authenticated operator could set dotnetbin=/bin/bash and sharpgenbin=<a file downloaded to the server> and execute arbitrary commands on the teamserver, frequently as root.

• Severity: Low (requires an authenticated operator)
• Affected: Merlin Server ≤ 2.2.1
• Fixed in: 2.2.2
• Reported by @lesteratSOL — thank you for the responsible disclosure.

Changes

Fixed

• Pin the dotnet executable and the SharpGen compiler DLL to fixed, server-side locations so an operator can no longer choose which binary the server runs. Compiling arbitrary C# still works — that input is compiler data, never executed on the server.

Changed

• Removed the now-inert dotnetbin and sharpgenbin options from the SharpGen module (both the module definition and the RPC handler).

Added

• New -dotnetBin server flag to configure the path to the dotnet executable (default dotnet, resolved from PATH). This is a server-launch setting — chosen by whoever runs the teamserver, not an operator-controllable option — so it restores install-location flexibility without reopening the vulnerability.

Upgrade notes

• Server-only release. The Merlin Agent and Merlin CLI are unaffected and do not need updating for this fix.
• If you previously pointed the SharpGen module at a dotnet outside your PATH (e.g. installed via dotnet-install.sh to ~/.dotnet), set it at launch instead: bash ./merlinServer -dotnetBin /path/to/dotnet ...
• The SharpGen compiler DLL is now always loaded from data/src/cobbr/SharpGen/bin/release/netcoreapp2.1/SharpGen.dll under the Merlin root (the standard submodule build location).

The data/bin directory contains compiled versions of the Merlin CLI and Merlin Agents

Merlin documentation and Wiki can be found here

The compressed files have a password of merlin