CVE-2020-36911: Covenant RCE Vulnerability via JWT Token

CVE-2020-36911 Overview

CVE-2020-36911 is a critical remote code execution vulnerability affecting Covenant versions 0.1.3 through 0.5. The vulnerability allows unauthenticated attackers to craft malicious JWT (JSON Web Token) tokens with administrative privileges, enabling them to bypass authentication controls entirely. Once authenticated as an administrator via forged tokens, attackers can upload custom DLL payloads to execute arbitrary commands on the target system.

Covenant is a .NET-based command and control (C2) framework used by red teams and security professionals for offensive security operations. The irony of this vulnerability is significant: a tool designed to help security teams conduct attacks against targets is itself vulnerable to the same type of attack, potentially allowing threat actors to compromise the hunters.

Critical Impact

Attackers can achieve full remote code execution on Covenant C2 servers by forging administrative JWT tokens and uploading malicious DLL payloads, potentially compromising red team infrastructure and sensitive operation data.

Affected Products

• Covenant versions 0.1.3 through 0.5
• Covenant C2 Framework (cobbr/Covenant)

Discovery Timeline

• 2026-01-13 - CVE CVE-2020-36911 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2020-36911

Vulnerability Analysis

This vulnerability stems from a hardcoded credentials weakness (CWE-798) in Covenant's JWT token validation mechanism. The C2 framework fails to properly validate JWT tokens, allowing attackers to forge authentication tokens with administrative role claims. This is particularly dangerous because Covenant operates as a centralized command and control server, typically containing sensitive information about ongoing red team operations, compromised hosts, and collected credentials.

The attack chain consists of two primary phases: first, the attacker crafts a malicious JWT token containing administrative privilege claims that bypass the authentication mechanism. Second, leveraging the administrative access, the attacker uploads a custom DLL payload through Covenant's task functionality, which then executes arbitrary commands with the privileges of the Covenant service process.

Root Cause

The root cause of this vulnerability is the use of hardcoded or predictable cryptographic secrets for JWT token signing and validation. When JWT secrets are static or predictable, attackers can forge valid tokens by signing their own claims with the known secret. This represents a fundamental cryptographic key management failure where sensitive authentication secrets were not properly protected or randomized.

Attack Vector

The attack is network-based and requires no prior authentication or user interaction. An attacker with network access to the Covenant server can exploit this vulnerability remotely. The exploitation workflow involves:

1. Identifying a vulnerable Covenant instance accessible over the network
2. Generating a forged JWT token with administrative role claims using the hardcoded secret
3. Authenticating to the Covenant API using the forged token
4. Uploading a malicious DLL payload through the administrative interface
5. Triggering execution of the DLL to achieve arbitrary command execution on the server

Public exploit code is available through the GitHub Covenant RCE Script and documented in Exploit-DB #51141. For detailed technical analysis, refer to the VulnCheck Covenant RCE Advisory and the Archived Blog on Hunter Tactics.

Detection Methods for CVE-2020-36911

Indicators of Compromise

• Unusual JWT tokens with administrative role claims from unexpected sources
• DLL file uploads to the Covenant server from unauthorized IP addresses
• Authentication events with forged or anomalous JWT token signatures
• Unexpected process execution spawned by the Covenant service process
• Network connections to Covenant API endpoints from external IP addresses

Detection Strategies

• Monitor Covenant server logs for authentication attempts with suspicious JWT tokens
• Implement network intrusion detection rules to identify exploitation attempts targeting Covenant instances
• Use endpoint detection to identify DLL uploads and execution within the Covenant installation directory
• Deploy file integrity monitoring on Covenant server directories to detect unauthorized file modifications

Monitoring Recommendations

• Enable verbose logging on all Covenant instances and forward logs to a SIEM for analysis
• Monitor for unusual outbound connections from Covenant servers that may indicate post-exploitation activity
• Set up alerts for any process execution initiated by the Covenant service that does not match expected behavior patterns
• Regularly audit authentication logs for tokens with administrative claims from new or unexpected sources

How to Mitigate CVE-2020-36911

Immediate Actions Required

• Upgrade Covenant to a version newer than 0.5 where this vulnerability has been addressed
• Immediately restrict network access to Covenant instances using firewall rules or network segmentation
• Conduct forensic analysis on any Covenant servers that may have been exposed to determine if exploitation occurred
• Review authentication logs for signs of forged JWT tokens or unauthorized administrative access

Patch Information

Users should upgrade to a version of Covenant beyond 0.5. The vulnerability was acknowledged by the Covenant maintainer, as documented in the Archived Twitter Update. For detailed information about Covenant and its updates, refer to the Cobbr Covenant Overview and the GitHub Covenant Repository.

Workarounds

• Isolate Covenant servers on dedicated network segments with strict access controls
• Implement additional authentication layers such as VPN access requirements before reaching Covenant instances
• Deploy a Web Application Firewall (WAF) in front of Covenant to filter malicious requests
• Monitor and restrict which users and systems can connect to Covenant administrative interfaces
• Consider disabling or removing vulnerable Covenant instances until patches can be applied