rootjog
Source-scoped identity with 1 associated PoC and 1 linked vulnerability.
Exploit catalog results
Showing 1 PoC on this page
MetasploitTaiga tribe_gig authenticated unserialize remote code execution
Metasploit exploitby whotwagnerAdded to Metasploit 2025-11-15ExploitCVE-2025-623681 file
Analysis
Technical assessment
Metasploit module that exploits an authenticated PHP unserialization vulnerability (CVE-2025-62368) in Taiga by sending a crafted payload in the 'tribe_gig' parameter when creating a user story, leading to remote code execution.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit authenticated RCE exploit for CVE-2025-62368. It authenticates, locates a project, and sends a base64-encoded Python deserialization payload via the 'tribe_gig' parameter to achieve code execution. No backdoor, deceptive payload, or concealed operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that sends a crafted deserialization payload to achieve remote code execution. It includes a check method, payload generation, and command execution logic.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:8modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:18-21modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:203-220Requirements
- Valid Taiga credentials (USERNAME, PASSWORD) are required.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:71-72 - A project with kanban activated must exist for the authenticated user.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:110
Observed behavior
- Authenticates to the Taiga API using supplied credentials.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:77-95 - Retrieves a project with kanban activated for the authenticated user.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:97-114 - Sends a base64-encoded Python deserialization payload in the 'tribe_gig' field of a user story creation request.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:145-157 - Executes arbitrary commands on the target via the deserialization payload.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:186-201 - Deletes the created user story as a cleanup step.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:135-143
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module exploits CVE-2025-62368 by sending a crafted payload to the Taiga API endpoint /api/v1/userstories.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:18-22modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:145-157 - Payload Generation
- Payload withheldThe module generates a Python deserialization payload to execute arbitrary commands or Meterpreter sessions.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:169-170modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:214-217 - Authentication
- Payload withheldThe module is post-authentication; it logs in to the Taiga API before exploitation.
modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:70-73modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:77-95
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The artifact was not executed; classification is based on static analysis of the provided text.
- Review is limited to the provided module source code. Framework mixins (e.g., Msf::Exploit::CmdStager, Msf::Util::PythonDeserialization) and external payloads are not expanded or analyzed.
- Binary files were not inspected; none were present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.