Security: unauthenticated /api/command + /api/python/execute with 0.0.0.0 bind — network-exposed RCE (API_HOST env ignored)

Summary

Static source review of hexstrike_server.py (master) found that the API server is network-exposed by default and has no authentication on any route, including two endpoints that execute arbitrary commands/Python. The banner and docs suggest it runs on localhost, but the actual bind is 0.0.0.0, and the API_HOST env var is never used for the bind.

Findings

1. Unauthenticated RCE endpoints (Critical)

• /api/command — executes arbitrary shell commands (hexstrike_server.py, ~line 9137)
• /api/python/execute — executes arbitrary Python (hexstrike_server.py, ~line 14498)
• None of the 156 routes require any authentication token.

2. Bind address ignores configuration (High)

• app.run(host="0.0.0.0") at hexstrike_server.py ~line 17289.
• API_HOST is defined (line ~99, default 127.0.0.1) but not used in the bind — the config is misleading.

Result: on any multi-user host, or if the port is forwarded/exposed, anyone on the network gets anonymous RCE. The startup banner printing 127.0.0.1:8888 does not match the actual bind.

Additional observations

• 101 f-string command constructions and subprocess.Popen(..., shell=True) (e.g. lines 5274, 6878) with no shlex.quote anywhere — command injection is possible through any MCP/tool parameter that reaches a command path.
• Arbitrary pip install of packages (hexstrike_server.py ~5720-5726) is a supply-chain vector when driven by untrusted input.
• No data exfiltration found (good): external calls are only NVD/GitHub APIs with CVE-IDs.

Suggested fixes

1. Bind to API_HOST (default 127.0.0.1): app.run(host=os.getenv("API_HOST", "127.0.0.1")).
2. Require an auth token (env HEXSTRIKE_TOKEN) on all routes, generated at first start and printed once.
3. Replace shell=True f-strings with argument lists + shlex.quote.
4. Gate or remove the arbitrary pip install path.

Happy to help test a patch. Thanks for the project!