Selenium Grid/Selenoid Unauthenticated RCE

MetasploitMetasploit exploitExploitRubyexploit_linux/http/selenium_greed_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit exploit module for unauthenticated remote code execution on Selenium Grid and Selenoid via WebDriver API. It auto-detects the backend and available browsers, then exploits Chrome via binary override or Firefox via malicious profile with MIME handler to execute a payload.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented remote code execution exploit against unauthenticated Selenium Grid/Selenoid instances. It uses standard Metasploit framework APIs to deliver a user-selected payload via Chrome binary override or Firefox profile handler techniques. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit functionality was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareSelenium GridSelenoid
Attack typesremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that includes check and exploit methods, constructs malicious HTTP requests to create browser sessions with payloads, and executes arbitrary commands on the target. It is classified as exploit because it actively exercises the vulnerability to achieve remote code execution.

modules/exploits/linux/http/selenium_greed_rce.rb:112-119modules/exploits/linux/http/selenium_greed_rce.rb:227-253modules/exploits/linux/http/selenium_greed_rce.rb:260-292

Requirements

  • Target must be running Selenium Grid or Selenoid without authenticationmodules/exploits/linux/http/selenium_greed_rce.rb:25-26
  • Target must have Chrome (unpatched Grid <4.11.0 or Selenoid) or Firefox availablemodules/exploits/linux/http/selenium_greed_rce.rb:29-38

Observed behavior

  • Detects backend type (Selenium Grid or Selenoid) by querying status endpointsmodules/exploits/linux/http/selenium_greed_rce.rb:148-161
  • Enumerates available browsers from backend metadatamodules/exploits/linux/http/selenium_greed_rce.rb:163-182
  • For Chrome, sends a session creation request with goog:chromeOptions binary set to /usr/bin/python3 and args containing a Python payloadmodules/exploits/linux/http/selenium_greed_rce.rb:227-235
  • For Firefox, builds a malicious profile ZIP with handlers.json mapping application/sh to /bin/sh, creates a session, and navigates to a data: URI to trigger shell executionmodules/exploits/linux/http/selenium_greed_rce.rb:260-303
  • Cleans up created sessions after exploitationmodules/exploits/linux/http/selenium_greed_rce.rb:220-225
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
Chrome binary override via goog:chromeOptionsThe module sets the Chrome binary to /usr/bin/python3 with attacker-controlled arguments to execute a payload.modules/exploits/linux/http/selenium_greed_rce.rb:232
Exploit Technique
Firefox profile handler injectionThe module creates a malicious Firefox profile that maps application/sh to /bin/sh, then navigates to a data: URI to trigger shell execution.modules/exploits/linux/http/selenium_greed_rce.rb:294-303
Payload Delivery
Standard Metasploit payload integrationThe module uses payload.encoded and Msf::Payload::Python mixin to deliver attacker-chosen payloads, consistent with normal Metasploit exploit behavior.modules/exploits/linux/http/selenium_greed_rce.rb:256modules/exploits/linux/http/selenium_greed_rce.rb:275
Review boundaries

What the analysis did not establish

  • Analysis is based on module source code only; framework mixins, libraries, and external payloads are not expanded.
  • No runtime behavior or network traffic was observed; classification relies solely on static code analysis.
  • Review is limited to the module source code; Metasploit framework mixins, libraries, and external payloads referenced by the module are not expanded or analyzed.
  • Binary files were not present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.