CVE-2023-38646-PoC

CVE-2023-38646 - Metabase RCE pre-autenticación Metabase de código abierto anterior a 0.46.6.1 y Metabase Enterprise anterior a 1.46.6.1 permiten a los atacantes ejecutar comandos arbitrarios en el servidor, con el nivel de privilegios del servidor. No se requiere autenticación para la explotació...

MetabaseRCE_CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 PoC Una prueba de concepto de CVE-2023-38646, un exploit de Metabase que permite al usuario ejecutar código de forma remota RCE utilizando el token de configuración encontrado en /api/session/properties para enviar un payload codificado en base64 Uso...

CVE-2023-38646

Metabase Pre Authentication RCE CVE-2023-38646 Hemos proporcionado dos archivos:- CVE-2023-38646-POC.py para comprobar si alguna instancia de Metabase está filtrando el setup-token. CVE-2023-38646-Reverse-Shell.py para obtener una reverse shell en la máquina controlada por el atacante...

metabase-pre-auth-rce-poc

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script written in Python that allows the exploitation of the Metabase's software security flaw described in CVE-2023-38646. The system is vulnerable in versions preceding 0.46.6.1 , in the open-source edition, and preceding 1.46.6.1 , in the...

Exploit-CVE-2023-38646-Metabase

Exploit CVE-2023-38646 Metabase before 0.46.6.1 open source and before 1.46.6.1 Enterprise Exploit for the Remote Code Execution RCE vulnerability identified in Metabase versions before 0.46.6.1 open source and 1.46.6.1 Enterprise. The vulnerability allows attackers to execute arbitrary commands ...

CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a python script which exploits the remote code execution vulnerability of Metabase's login software. It allows us to execute arbitrary commands on the server before authentication. Vulnerable versions are Metabase open source before 0.46.6.1 and...

CVE-2023-38646

CVE-2023-38646 Metabase RCE sin autenticación 26/11/2023 Metabase open source anterior a 0.46.6.1 y Metabase Enterprise anterior a 1.46.6.1 permiten a los atacantes ejecutar comandos arbitrarios en el servidor, al nivel de privilegio del servidor. No se requiere autenticación para la explotación...

CVE-2023-38646

CVE-2023-38646 Original script from securezeron During testing, I found that the reverse shell generated by this POC failed due to the trailing '=' character after base64 encoding. I made a slight modification to fix this issue. root@kitploit: Original reverse shell payload generation code...

AZL-35452 CVE-2024-26594 affecting package hyperv-daemons for versions less than 5.15.153.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid...

Exploit for CVE-2023-38646

Exploit CVE-2023-38646 Metabase before 0.46.6.1 open source...

Metabase 0.46.6 Remote Code Execution

Exploit Title: metabase 0.46.6 - Pre-Auth Remote Code Execution Google Dork: N/A Date: 13-10-2023 Exploit Author: Musyoka Ian Vendor Homepage: https://www.metabase.com/ Software Link: https://www.metabase.com/ Version: metabase 0.46.6 Tested on: Ubuntu 22.04, metabase 0.46.6 CVE : CVE-2023-38646...

Exploit for CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase ope...

Exploit for CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabas...

Exploit for CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabas...

Exploit for CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a python sc...

Exploit for CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script w...

Metabase Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Metabase Setup Token RCE', 'Description' = %q Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even...

Metabase Setup Token RCE

Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even after the setup process has been completed. With this token a user is able to submit the setup functionality to create a new database. When creating a new database, an H2 database string is created wi...