Unauthenticated remote code execution via agent update channel

Synopsis

Helix Fleet agents poll the management server for update packages on TCP port 8443. The agent verifies that the package is a valid archive, but not that it is signed by Helix Systems. Any host that can answer on the update channel, including one positioned with ARP or DNS spoofing on the same network segment, can serve a package that the agent installs and runs as SYSTEM.

Because every managed endpoint trusts the same channel, a single foothold on the network becomes code execution across the fleet.

Proof of concept

The agent’s update check accepts any archive with a well-formed manifest. A minimal manifest is enough to have a script executed after extraction:

{
	"package": "helix-agent-update",
	"version": "11.9.0",
	"post_install": "scripts/post.ps1"
}

A full proof of concept is available to Helix Systems customers on request through the address below.

Mitigations

No patch is available. Until Helix Systems ships a fix, reduce exposure:

1. Restrict the update port (TCP 8443) so agents only reach the management server, using host firewall rules pushed through Group Policy.
2. Enable DHCP snooping and dynamic ARP inspection on access switches to make interception harder.
3. Monitor for helix-agent.exe spawning PowerShell or cmd.exe, which normal updates never do.