MajorDoMo Supply Chain RCE via Update Poisoning

MetasploitMetasploit exploitExploitRubyexploit_multi/http/majordomo_supply_chain_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-27180, an unauthenticated RCE in MajorDoMo's saverestore module. It poisons the update URL, serves a malicious Atom feed and tarball via an integrated HTTP server, and executes a PHP webshell payload.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2026-27180. It chains two unauthenticated HTTP requests to poison a target's update URL and trigger a supply-chain update that deploys a Metasploit-generated payload. All behavior is consistent with the documented exploit flow: it starts an HTTP server to serve a crafted Atom feed and tarball, poisons the target's MASTER_UPDATE_URL, triggers the update, and then requests the deployed webshell to execute the payload. No concealed, deceptive, or operator-directed harm beyond the stated exploit is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareMajorDoMo
Attack typesremote code executionsupply chain attack
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by sending malicious requests, serving a payload, and executing it on the target to achieve remote code execution.

modules/exploits/multi/http/majordomo_supply_chain_rce.rb:1-258

Requirements

  • Target must be running a vulnerable version of MajorDoMo with the saverestore module accessible.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:24-28
  • Attacker's HTTP server (SRVHOST) must be reachable from the target to serve the Atom feed and tarball.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:234modules/exploits/multi/http/majordomo_supply_chain_rce.rb:248

Observed behavior

  • Sends a GET request to /objects/?module=saverestore&mode=auto_update_settings&set_update_url=<attacker_url> to poison the MASTER_UPDATE_URL.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:168-176
  • Sends a GET request to /objects/?module=saverestore&mode=force_update to trigger the update process.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:179-188
  • Starts an HTTP server that serves a crafted Atom feed and a malicious tarball containing a PHP webshell.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:211-232
  • Waits for the target to fetch the feed and tarball, then sends a GET request to the deployed webshell to execute the payload.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:240-256
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Flow
Two-step unauthenticated RCE via update URL poisoning and forced updateThe module implements the documented exploit chain: poison_update_url sets the MASTER_UPDATE_URL (lines 166-177), trigger_update initiates the update (lines 179-189), and execute_webshell triggers the deployed payload (lines 191-197).modules/exploits/multi/http/majordomo_supply_chain_rce.rb:166-197
Http Server
Module starts an HTTP server to serve Atom feed and tarballThe exploit method starts an HTTP server (lines 211-232) that serves a fake Atom feed and a tarball containing the Metasploit payload. This is necessary for the supply-chain attack and is not a backdoor.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:211-232
Payload Generation
PHP payload embedded in tarball webshellThe module generates a PHP webshell containing the Metasploit payload (lines 200-202) and packages it into a tarball (lines 147-164). This is the standard Metasploit payload delivery mechanism.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:200-202modules/exploits/multi/http/majordomo_supply_chain_rce.rb:147-164
Review boundaries

What the analysis did not establish

  • Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include execution output or confirmation that the exploit was successfully run.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded in the evidence.
  • Binary files were not inspected (none present in this evidence).
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1