Metasploit Weekly Wrap-Up

Pollution in Kibana This week, contributor h00die added a module that leverages a prototype pollution bug in Kibana prior to version 7.6.3. Particularly, this issue is within the Upgrade Assistant and enables an attacker to execute arbitrary code. This vulnerability can be triggered by sending a...

F5 Networks BIG-IP : BIG-IP Configuration utility RCE (K000135689)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.0.3 / 16.1.4.1 / 15.1.10.2 / 14.1.5.6. It is, therefore, affected by a vulnerability as referenced in the K000135689 advisory. A directory traversal vulnerability exists in the BIG-IP Configuration utility that may...

PyTorch Model Server Registration / Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'PyTorch Model Server Registration and Deserialization RCE', 'Description' = %q The PyTorch model server contains multiple...

Authentication Bypass

neuvector is vulnerable to Authentication Bypass. An attacker can reverse engineer a JWT token, forging a valid taken to perform malicious activity. This can lead to RCE...

Clinic's Patient Management System 1.0 Shell Upload

Exploit Title: Clinic's Patient Management System 1.0 - Unauthenticated RCE Date: 07.10.2023 Exploit Author: Oğulcan Hami Gül Vendor Homepage: https://www.sourcecodester.com/php-clinics-patient-management-system-source-code Software Link:...

WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE)

Software Nexter Extension Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-45751 Patch priority Medium CVSS severity Medium 9.1 Developer POSIMYTH Innovations PSID 69a3443fb3d9 Credits Rafie Muhammad Patchstack...

Patch Tuesday - October 2023

Microsoft is addressing 105 vulnerabilities this October Patch Tuesday, including three zero-day vulnerabilities, as well as 12 critical remote code execution RCE vulnerabilities, and one republished third-party vulnerability. WordPad: zero-day NTLM hash disclosure Another Patch Tuesday, another...

CVE-2023-36415

CVE-2023-36415 corresponds to a Remote Code Execution vulnerability in the Azure Identity SDK affecting multiple language SDKs (Java, Python, .NET, JavaScript). The issue is exploitable over the network with low attack complexity and low privileges, and has a High impact on confidentiality, integ...

CVE-2023-36418 Azure RTOS GUIX Studio Remote Code Execution Vulnerability

...

CVE-2023-30801 qBittorrent Web UI Default Credentials Lead to RCE

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...

libcue Library Flaw Opens GNOME Linux Systems Vulnerable to RCE Attacks

A new security flaw has been disclosed in the libcue library impacting GNOME Linux systems that could be exploited to achieve remote code execution RCE on affected hosts. Tracked as CVE-2023-43641 CVSS score: 8.8, the issue is described as a case of memory corruption in libcue, a library designed...

BoidCMS 2.0.0 Shell Upload

!/usr/bin/python3 Exploit Title: BoidCMS v2.0.0 - authenticated file upload vulnerability Date: 08/21/2023 Exploit Author: 1337kid Vendor Homepage: https://boidcms.github.io// Software Link: https://boidcms.github.io/BoidCMS.zip Version: ' with open'shell.php','w' as f: f.writelinesphpcode ====...

PaperCut NG Path Traversal/File Upload RCE (CVE-2023-39143)

Binary data papercutngcve-2023-39143.nbin...

Coppermine Gallery 1.6.25 Remote Code Execution

Exploit Title: coppermine-gallery 1.6.25 RCE Application: coppermine-gallery Version: v1.6.25 Bugs: RCE Technology: PHP Vendor URL: https://coppermine-gallery.net/ Software Link: https://github.com/coppermine-gallery/cpg1.6.x/archive/refs/tags/v1.6.25.zip Date of found: 05.09.2023 Author: Mirabba...

PaperCut MF Path Traversal/File Upload RCE (CVE-2023-39143)

Binary data papercutmfcve-2023-39143.nbin...

Cracking ShellTorch Vulnerabilities Exposing TorchServe to RCE

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A trio of security vulnerabilities, dubbed ShellTorch, in the open-source machine-learning model TorchServe, a tool for serving and scaling PyTorch models, could be chained to achieve remote code...

Exploit for CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script w...

CVE-2023-45353

CVE-2023-45353 affects Atos Unify OpenScape Common Management Portal (OCMP) prior to V10 R4.17.0 and prior to V10 R5.1.0. An authenticated attacker can upload and create arbitrary files via the web interface, enabling arbitrary code execution on the underlying OS. Root cause: insecure authenticat...

Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload

Description The plugin does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. PoC Make sure you have Elementor installed and a page or post edited with Elementor. Here's the python script that will execute the...

Wordpress Media Library Assistant Plugin - Remote Code Execution / Local File Inclusion Exploit

Exploit Title: Media Library Assistant Wordpress Plugin - RCE and LFI CVE: CVE-2023-4634 Exploit Author: Florent MONTEL / Patrowl.io / @Pepitoh / Twitter @Pepitooh Exploitation path: https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/ Exploit:...