CVE-2024-7591

CRITICALNuclei

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-7591 has a selected CVSS score of 10.0 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 10, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

LoadMaster

Browse Progress / LoadMaster

Default status: unaffected

CVE List7.2.40.0 to < 7.2.60.1affected

loadmaster

Browse kemptechnologies / loadmaster

Default status: unaffected

CVE List7.2.40.0 to ≤ 7.2.60.0affected

loadmaster_mt

Browse kemptechnologies / loadmaster_mt

Default status: unaffected

CVE List7.1.35.4 to ≤ 7.1.35.11affected

Proofs of concept

1

Repository PoCs

GitHubbutyraldehyde/CVE-2024-7591-PoCRepository PoCby butyraldehyde0Exploit4 files

23.0 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python scripts that exploit CVE-2024-7591, an OS command injection vulnerability in Progress Kemp LoadMaster. KempExploit.py automates the full attack: it fetches CSRF tokens from the login page, encodes a user-supplied shell command into the 'pass' parameter, and sends a POST request to /progs/status/login to execute the command on the target. KempRCECommandGenerator.py is a helper that generates the encoded payload for manual use.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of two Python scripts and a README that implement and document a proof-of-concept for CVE-2024-7591, an OS command injection vulnerability in Progress LoadMaster. The code constructs and sends a crafted HTTP POST request to inject a user-supplied shell command into the 'pass' parameter of a login endpoint. All behavior is consistent with a legitimate security testing tool: it reads a command from the user, encodes it, and sends it to the target. No concealed, deceptive, or operator-directed harmful behavior (such as credential theft, persistence, or unrelated payloads) is present in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareProgress Kemp LoadMaster
Attack typesOS command injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

KempExploit.py is a fully functional exploit that automates the entire attack chain: token extraction, payload encoding, and delivery of an OS command injection payload to achieve remote code execution. The README explicitly states it is for 'testing the Kemp LoadMaster for remote code execution' and provides example output showing command execution.

README.md:1-2KempExploit.py:55-69KempExploit.py:125-158

Requirements

  • Target running a vulnerable version of Progress Kemp LoadMaster (7.2.40.0 and above, ECS all versions, Multi-Tenancy 7.1.35.4 and above).KempExploit.py:1
  • Network access to the target's web interface (/progs/homepage and /progs/status/login).KempExploit.py:88KempExploit.py:125

Observed behavior

  • Fetches the /progs/homepage to extract CSRF tokens (token, token2) from the HTML form.KempExploit.py:88-108
  • Encodes a user-provided shell command by wrapping it in single quotes and semicolons, padding to a length divisible by 4, converting to percent-encoded hex, and adding %01 delimiters.KempExploit.py:55-69
  • Sends a POST request to /progs/status/login with the encoded command in the 'pass' field, causing the server to execute the injected OS command.KempExploit.py:125-158
  • Checks the response for the string 'exploitable' to confirm successful command execution when no custom command is provided.KempExploit.py:168-171
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
Payload withheldThe script injects a user-supplied OS command into the 'pass' field of a POST request to /progs/status/login, which is the documented exploit vector for CVE-2024-7591.KempExploit.py:135
Default Test Command
Payload withheldA hardcoded default command that echoes 'exploitable' is used when the user provides no command, serving as a non-destructive vulnerability test.KempExploit.py:53
User Interaction Prompt
Payload withheldThe script explicitly prompts the user for the command to execute, demonstrating that command execution is user-driven and not hidden.KempExploit.py:73
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the text evidence; it is unlikely to contain exploit logic.
  • The evidence does not include the target server or network traffic captures; the analysis is based solely on the provided source code and documentation.
  • One file (LICENSE) was omitted from the text evidence; its metadata indicates it is a standard Apache 2.0 license, which is unlikely to contain executable behavior.
  • Binary files were not present in the evidence.
  • The review is limited to static analysis of the provided text; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryCRITICALKemp LoadMaster Load Balancer - Unauthenticated Command InjectionCVSS 10

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: LoadMaster: 7.2.40.0 and above. ECS: All versions.Multi-Tenancy: 7.1.35.4 and above.

Impact

Unauthenticated attackers can execute arbitrary OS commands on the LoadMaster load balancer through command injection, achieving complete system compromise with potential to pivot to backend infrastructure.

Remediation

Apply security updates from Kemp Technologies as specified in their security advisory for LoadMaster versions 7.2.40.0 and above, ECS all versions, and Multi-Tenancy 7.1.35.4 and above.

WeaknessesCWE-78
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024loadmasterrceoastkemptechnologiesvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CPE: cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*
Shodan: html:"Kemp Login Screen"
https://insinuator.net/2024/11/vulnerability-disclosure-command-injection-in-kemp-loadmaster-load-balancer-cve-2024-7591/ https://nvd.nist.gov/vuln/detail/cve-2024-7591 https://support.kemptechnologies.com/hc/en-us/articles/29196371689613-LoadMaster-Security-Vulnerability-CVE-2024-7591 https://insinuator.net/2024/11/vulnerability-disclosure-command-injection-in-kemp-loadmaster-load-balancer-cve-2024-7591

Source: ProjectDiscovery

References

4