RoboTask REST API Unauthenticated Remote Task Execution (CWE-306) — Detect

Fingerprint / reachability check for RoboTask REST API Unauthenticated Remote Task Execution CWE-306 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for RoboTask REST API Unauthenticated Remote Task Execution CWE-306""" from kittysploit import from lib.protocols.http.httpclient import...

RoboTask REST API unauthenticated task execution

RoboTask REST API default port 9999 with RestUseApiKeys=0 accepts unauthenticated POST /api/tasks/id/run and executes preconfigured task actions with the RoboTask service privilege. !/usr/bin/env python3 -- coding: utf-8 -- """RoboTask REST API unauthenticated remote task execution CWE-306.""" fr...

RoboTask 11.0.5.1229 Authentication Bypass

RoboTask version 11.0.5.1229 contains a missing authentication vulnerability in its REST API. When the REST service is enabled with its default API-key setting, a remote unauthenticated attacker can enumerate and trigger existing tasks. Tasks execute with the privileges of the RoboTask process an...