
PoC exploit for unauthenticated remote code execution in DBGate via the /runners/start endpoint, with blind RCE mode and container-based testing scripts.
Unauthenticated RCE in DBGate <= 7.1.8
rce.py
Minimal implementation of RCE on /runners/start,
Privileged
If process can write to ./public/ folder, file /favicon.svg is used to retrieve command output.
$ rce.py whoami
root
If not, then command will run blind:
./rce.py -b sleep 300
run.sh / shell.sh
Run local containers using podman, check UID variable to run process with distinct privileges.