SSRF on Sliver C2 teamserver via spoofed implant callback (CVE-2025-27090)

Summary Sliver C2 is a open source cross-platform adversary emulation/red team framework utilized by red teamers and threat actors alike. While auditing the codebase, I was able to discover a vulnerability in which attackers could open a TCP connection on the teamserver to an arbitrary IP/port, and read and write traffic through the socket (a powerful form of SSRF). The consequences of exploiting this vulnerability could be anything from leaking teamserver IPs behind redirectors to moving laterally from the teamserver to other services.