HPE OneView unauthenticated RCE

MetasploitMetasploit exploitExploitRubyexploit_linux/http/hpe_oneview_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Metasploit exploit module for CVE-2025-37164, an unauthenticated remote code execution vulnerability in HPE OneView. It sends a crafted PUT request to the /rest/id-pools/executeCommand endpoint to execute arbitrary commands on the target.

Backdoor review

No backdoor observed in reviewed code

The supplied Metasploit module source code implements a straightforward unauthenticated RCE exploit for CVE-2025-37164 against HPE OneView. It sends a crafted PUT request to the /rest/id-pools/executeCommand endpoint to execute a user-supplied payload. No backdoor, deceptive payload, persistence mechanism, credential theft, or unrelated remote access behavior is present. The module's check method uses a benign echo command, and the exploit method executes the attacker-chosen payload, which is standard Metasploit exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareHPE OneView
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the CVE-2025-37164 vulnerability to achieve remote code execution. The 'exploit' method sends a malicious payload to the target, and the 'check' method uses the same vulnerability to verify exploitability.

modules/exploits/linux/http/hpe_oneview_rce.rb:121-122modules/exploits/linux/http/hpe_oneview_rce.rb:100-102

Requirements

  • Target must be running a vulnerable version of HPE OneView (below 11.00 without hotfix) with the ID Pools endpoint enabled.modules/exploits/linux/http/hpe_oneview_rce.rb:18-21

Observed behavior

  • Sends a PUT request to /rest/id-pools/executeCommand with a JSON body containing a 'cmd' field to execute an arbitrary system command.modules/exploits/linux/http/hpe_oneview_rce.rb:143-156
  • The exploit method sends the attacker's payload encoded for shell execution via the execute_cmd function.modules/exploits/linux/http/hpe_oneview_rce.rb:121-122
  • The check method exploits the vulnerability with a benign command (echo with a UUID) to determine if the target is vulnerable.modules/exploits/linux/http/hpe_oneview_rce.rb:100-102
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Endpoint
/rest/id-pools/executeCommandThe module sends a PUT request to this endpoint with a JSON body containing a 'cmd' field to achieve command execution.modules/exploits/linux/http/hpe_oneview_rce.rb:144-156
Check Command
echo <uuid>The check method executes a benign echo command with a random UUID to verify vulnerability without causing harm.modules/exploits/linux/http/hpe_oneview_rce.rb:100-102
Payload Execution
sh -c <payload>The exploit method wraps the user-supplied payload in a shell command for execution, which is standard for cmd-based exploits.modules/exploits/linux/http/hpe_oneview_rce.rb:121-122modules/exploits/linux/http/hpe_oneview_rce.rb:153
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Ruby source code and metadata; framework mixins, libraries, and external payloads are not included.
  • The code was not executed, and its operational reliability or safety is not verified.
  • Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded or inspected.
  • Binary files were flagged as metadata-only and not analyzed, but no binary files were present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1