Metabase Pre-auth RCE (CVE-2023-38646)!!
CVE-2023-38646 Pre-Auth RCE in Metabase
RCE Exploit for CVE-2023-38646
Python exploit for Metabase pre-auth RCE (CVE-2023-38646) that establishes a reverse shell for authorized security testing.
This script is designed to exploit vulnerable Metabase software versions by providing you as attacker a shell.
Exploit for CVE-2023-38646 in Metabase 0.46.6, enabling remote code execution via crafted requests and setup token retrieval.
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
Python exploit for Metabase pre-authentication remote code execution (CVE-2023-38646) with reverse shell payload delivery.
Python exploit for Metabase pre-authentication remote code execution (CVE-2023-38646) with setup-token extraction and collaborator callback for unauthenticated server compromise.
This is a script written in Python that allows the exploitation of the Metabase's software security flaw described in CVE-2023-38646.
CVE-2023-38646 Unauthenticated RCE vulnerability in Metabase
Python exploit script for CVE-2023-38646, a pre-authentication remote code execution vulnerability in Metabase, delivering a reverse shell to an attacker-controlled host.
Exploit script for Pre-Auth RCE in Metabase (CVE-2023-38646)
Tools to exploit metabase CVE-2023-38646
Python script to exploit CVE-2023-38646 Metabase Pre-Auth RCE via SQL injection
Automatic Tools For Metabase Exploit Known As CVE-2023-38646
POC for CVE-2023-38646
Metabase Pre-auth RCE
This is a Proof of Concept (PoC) script for exploiting Metabase, an open-source business intelligence and data analytics tool.
PoC exploit for CVE-2023-38646, a pre-authentication RCE in Metabase. Includes a reverse shell payload generator with base64 encoding fix for reliable exploitation.
CVE-2023-38646 Metabase RCE
Proof-of-Concept script for exploiting CVE-2023-38646. Intended for educational and research purposes only.
Exploit for the Remote Code Execution (RCE) vulnerability identified in Metabase versions before 0.46.6.1 (open source) and 1.46.6.1 (Enterprise). Authentication is not required for exploitation.
Proof-of-concept exploit for CVE-2023-38646 in Metabase, allowing remote code execution via crafted requests. Includes a Python script to check vulnerable versions.
Metabase postgres (org.h2.Driver) RCE without INIT
Exploit for CVE-2023-38646 in Metabase, achieving remote code execution and privilege escalation to root via unshare and setuid techniques.
Go-based exploit for CVE-2023-38646 in Metabase, enabling remote code execution and reverse shell connection to an attacker-controlled host.
Proof-of-concept exploit for CVE-2023-38646, a critical vulnerability in Metabase, demonstrating remote code execution via crafted JDBC connection.
CVE-2023-38646是Metabase中的一个远程代码执行漏洞。该漏洞源于Metabase在处理未经身份验证的API端点/api/setup/validate时，对JDBC连接字符串的处理存在安全缺陷。攻击者可以通过构造特定的JDBC连接字符串，利用该端点在服务器上执行任意命令，而无需进行身份验证。
Metabase H2 远程代码执行漏洞(CVE-2023-38646)
Proof-of-concept exploit for CVE-2023-38646, demonstrating remote code execution in a web application. Intended for security testing and vulnerability validation.
Code to detect/exploit vulnerable metabase application
Repo contains the PoC and steps to reproduce cve 2023-38646
CVE-2023-38646
For educational purposes only
Proof of Concept for CVE-2023-38646
