CVE-2013-1814

This is a writeup describing an information leakage vulnerability in Apache Rave versions 0.11 to 0.20, where the User RPC API exposes sensitive user data, including hashed passwords, to authenticated users. The example demonstrates how a simple API request can retrieve this data.

This Metasploit module exploits an information disclosure vulnerability in Apache Rave 0.20 and prior by authenticating with default or provided credentials and then querying the RPC API to retrieve user information, including password hashes.