Pretalx Limited File Write to Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_linux/http/pretalx_rce_cve_2023_28458

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2023-28458, a path traversal in Pretalx HTML export, to write a malicious Python site-specific configuration hook, achieving remote code execution when the Pretalx user runs Python code.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2023-28458. It uses a path traversal to write a Python site-specific configuration hook containing the user-supplied payload. No concealed backdoor, unrelated remote access, or deceptive behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagesruby
Target softwarePretalx
Attack typespath traversalremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module contains explicit code to exploit CVE-2023-28458 by writing a malicious Python hook to the target filesystem and executing an attacker-supplied payload. The exploit method constructs a path traversal payload, uploads a resource with OS command execution, and triggers the file write via schedule export.

modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:83-122

Requirements

  • Valid Pretalx organizer credentials (EMAIL, PASSWORD)modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:52-53
  • Pretalx must be running in debug modemodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:66
  • Target Pretalx version <= 2.3.1modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:68

Observed behavior

  • Logs into Pretalx with supplied credentialsmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:60
  • Registers a malicious speaker and proposalmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:84-91
  • Uploads a resource containing a Python payload that executes an OS commandmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:101-103
  • Uses a path traversal in the proposal description to write the uploaded resource to a Python site-packages hook locationmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:112
  • Triggers the file write by adding the proposal to the schedule, releasing the schedule, and exporting it as ZIPmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:114-120
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Execution
resource_data = %(import os;os.system("#{payload.encoded}") )The module writes a Python hook that executes the Metasploit payload. This is the intended exploit behavior, not a backdoor.modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:103
Path Traversal
write_primitive_description contains path traversal sequences (e.g., ../../..)The path traversal is the core of CVE-2023-28458 exploitation, used to place the payload hook in a Python site-packages directory. This is the documented vulnerability, not a backdoor.modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:112
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module was not executed; classification is based on static analysis of the provided Ruby source.
  • Only the module source was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • The review does not assess the safety or reliability of the module or its payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1