Exploitation Summary
EIP tracks 5 public exploits for CVE-2024-47533. PoCs published by dollarboysushil, baph00met, zs1n. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional exploit for CVE-2024-47533, targeting Cobbler's XMLRPC authentication bypass vulnerability. It leverages the flawed `utils.get_shared_secret()` function to execute arbitrary commands via reverse shell payloads.
Description
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
Exploits (5)
This is a functional exploit for CVE-2024-47533, targeting Cobbler's XMLRPC authentication bypass vulnerability. It leverages the flawed `utils.get_shared_secret()` function to execute arbitrary commands via reverse shell payloads.
This PoC exploits CVE-2024-47533 in Cobbler by leveraging an authentication bypass and template injection to achieve remote code execution. It creates a malicious kickstart template with embedded Python code that executes arbitrary commands during the rendering process.
This PoC exploits an authentication bypass in Cobbler's XMLRPC interface (CVE-2024-47533) by leveraging a flawed shared secret function to execute arbitrary commands via the `background_import` method, resulting in remote code execution.
This exploit leverages an authentication bypass in Cobbler's XML-RPC API (CVE-2024-47533) to execute a reverse shell via a malicious kickstart template. It bypasses authentication by using an empty username and a password of -1, then triggers payload execution through profile rendering.
This is a functional PoC exploit for CVE-2024-47533, an authentication bypass in Cobbler's XML-RPC interface leading to unauthenticated RCE via command injection in the `background_import` function.
Nuclei Templates (1)
http.title:"Cobbler Web Interface"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H