CVE-2024-47533-Cobbler-XMLRPC-Authentication-Bypass-RCE-Exploit-POC

CVE-2024-47533 - Cobbler XMLRPC प्रमाणीकरण बाईपास RCE शोषण ⚠️ Cobbler में प्रमाणीकरण बाईपास के माध्यम से गंभीर रिमोट कोड निष्पादन 🛠️ @dollarboysushil द्वारा PoC कार्यान्वयन 💡 अवलोकन Cobbler, एक Linux स्थापना सर्वर जो नेटवर्क स्थापना वातावरण के त्वरित सेटअप को सक्षम करता है, में संस्करण 3.0.0 से...

Cobbler 'XML-RPC' - Authentication Bypass

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

CVE-2024-47533

CVE-2024-47533 – Cobbler XML-RPC 인증 우회 익스플로잇 📜 설명 CVE-2024-47533은 네트워크 기반 OS 설치를 자동화하는 Linux 설치 서버인 Cobbler의 치명적인 인증 우회 취약점 입니다. 이 결함은 utils.getsharedsecret의 문제로 인해 발생하며, 이 함수는 항상-1을 반환하여 Cobbler XML-RPC API에 대한 인증되지 않은 접근을 가능하게 합니다. 공격자는 다음 자격 증명으로 연결할 수 있습니다: 사용자 이름: "" 빈 문자열 비밀번호: -1 이를 통해 배포판...

CVE-2024-47533

CVE-2024-47533 - Эксплойт RCE с обходом аутентификации XMLRPC в Cobbler Критическое удалённое выполнение кода через обход аутентификации в Cobbler Реализация PoC. Краткое описание Cobbler, сервер установки Linux, обеспечивающий быструю настройку сетевых установочных сред, имеет уязвимость...

CVE-2024-47533-PoC

CVE-2024-47533 – Bypass autenticazione Cobbler XMLRPC → Reverse Shell RCE non autenticato 📌 Riepilogo Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2024-47533 , un bypass critico dell'autenticazione nell'API XMLRPC di Cobbler che porta a esecuzione remota di codice RCE non...

Cobbler <3.3.0 - Remote Code Execution

Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. id: CVE-2021-40323 info: name: Cobbler 3.3.0 - Remote Code Execution author: c-sh0 severity: critical description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via ...

PYSEC-2026-792 Cobbler subject to Command Injection

A Command Injection in actionpower.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

PYSEC-2026-794 Cobbler is vulnerable to code injection

templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...

PYSEC-2026-793 Cobbler vulnerable to code injection via unsafe YAML loading

The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...

PYSEC-2026-795 Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...

PYSEC-2026-797 Cobbler Path Traversal vulnerability

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile...

Cobbler XSS Vulnerability

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting XSS vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to...

PYSEC-2026-796 Cobbler XSS Vulnerability

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting XSS vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to...

PYSEC-2026-623 Cobbler Arbitrary File Read

A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation...

PYSEC-2026-624 Cobbler Web Interface Lacks CSRF Protection

cobbler: Web interface lacks CSRF protection when using Django framework...

cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

Summaryutils.getsharedsecret always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes. Detailsutils.py getsharedsecret:def getsharedsecret - Unionstr, int: """ The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree on...

PYSEC-2026-316 cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

Summary utils.getsharedsecret always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes. Details utils.py getsharedsecret: def getsharedsecret - Unionstr, int: """ The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree o...

Cobbler has Exposed Dangerous Method or Function

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

Cobbler Improper Validation of Security Tokens

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...