CVE-2024-8504
HIGHVICIdial Agent Interface - Authenticated Root Command Execution
Title source: manualExploitation Summary
EIP tracks 3 public exploits for CVE-2024-8504.
PoCs published by Chocapikk, havokzero, Valentin Lobstein, Jaggar Henry of KoreLogic, Inc., including Metasploit module exploits/unix/webapp/vicidial_agent_authenticated_rce.
AI-analyzed exploit summary This repository contains a combined exploit for CVE-2024-8503 (unauthenticated SQLi) and CVE-2024-8504 (authenticated RCE) in VICIdial. The exploit retrieves admin credentials via SQLi and achieves RCE via poisoned recording files.
Description
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
Exploits (3)
This repository contains a combined exploit for CVE-2024-8503 (unauthenticated SQLi) and CVE-2024-8504 (authenticated RCE) in VICIdial. The exploit retrieves admin credentials via SQLi and achieves RCE via poisoned recording files.
The repository contains a functional exploit suite for ViciDial, featuring SQL injection for credential extraction and remote code execution capabilities. It includes API interaction modules for post-exploitation activities.
This Metasploit module exploits an authenticated RCE vulnerability in VICIdial (CVE-2024-8504) by chaining multiple steps, including authentication, privilege escalation, and payload execution via a cron job. It requires valid admin credentials and targets versions <= 2.14-917a.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H