OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution

ExploitDBExploitDB exploitExploitEDB-52633

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-58138 in Orkes Conductor to achieve unauthenticated remote code execution by submitting a malicious INLINE JavaScript task that uses Java reflection to execute arbitrary OS commands.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python exploit for CVE-2026-58138. It constructs a malicious JavaScript payload that uses Java reflection to execute a user-supplied OS command on the target Conductor server, then retrieves the output. All behavior is consistent with the stated purpose of demonstrating unauthenticated RCE. No concealed executable behavior, persistence, credential theft, or unrelated payloads were observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareOrkes ConductorConductor OSS
Attack typesremote code executioncode injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script is a complete, self-contained Python program that actively exploits the vulnerability by sending crafted HTTP requests to execute arbitrary OS commands on the target. It does not merely detect or report the vulnerability; it performs the exploitation and retrieves command output.

exploits/multiple/webapps/52633.py:1-139

Requirements

  • Target running vulnerable Orkes Conductor (3.21.21 to <3.30.2) with default community API behavior (no authentication required).exploits/multiple/webapps/52633.py:12exploits/multiple/webapps/52633.py:32

Observed behavior

  • Constructs a JavaScript expression that uses Java reflection to obtain java.lang.Runtime, build a String array containing 'sh', '-c', and the attacker-supplied command, then invokes Runtime.exec() to execute the command.exploits/multiple/webapps/52633.py:55-73
  • Registers a new workflow definition containing the malicious INLINE task via an unauthenticated POST to /api/metadata/workflow.exploits/multiple/webapps/52633.py:100-117
  • Starts the workflow via POST to /api/workflow/<name>, then fetches the workflow output to retrieve the command execution result.exploits/multiple/webapps/52633.py:118-133
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
The script builds a JavaScript expression that invokes Runtime.exec with a user-supplied command.This is the core exploit mechanism for the claimed vulnerability.exploits/multiple/webapps/52633.py:55-73
Network Request
The script sends HTTP requests to the target Conductor API to register a workflow and retrieve task output.This is the delivery and retrieval mechanism for the exploit.exploits/multiple/webapps/52633.py:76-90exploits/multiple/webapps/52633.py:117-118
Review boundaries

What the analysis did not establish

  • Evidence is limited to the single Python script; no external dependencies, network captures, or execution logs are included.
  • The script's effectiveness depends on the target's configuration and the presence of the vulnerability; no verification of successful exploitation is provided in the evidence.
  • Only the single Python file was reviewed; no external dependencies or referenced resources were inspected.
  • The review does not assess the safety or correctness of the exploit against the target system.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1