CVE-2020-4429

This repository provides a functional proof-of-concept for CVE-2020-4429, which involves a default password vulnerability in IBM Data Risk Manager. The PoC includes credentials for an administrative account that can be used to gain root privileges via SSH.

This Metasploit module exploits a chain of vulnerabilities in IBM Data Risk Manager (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) to achieve unauthenticated remote code execution as root. It bypasses authentication, injects commands, and abuses an insecure default password.

This Metasploit module exploits CVE-2020-4429, an arbitrary file download vulnerability in IBM Data Risk Manager (IDRM) versions 2.0.2 to 2.0.4. It chains an authentication bypass (CVE-2020-4427) with a path traversal to download sensitive files, such as Tomcat's application.properties, which contains database credentials.

This Metasploit module exploits a known default password vulnerability in IBM Data Risk Manager, allowing SSH login as 'a3user' with password 'idrm' and escalating to root via sudo. It is a reliable exploit for versions <= 2.0.6.1.