deardaniel/secdata-raw huggingface dataset:
Metasploit Module: GeoServer WMS GetMap XXE Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb
Disclosure date: 2025-11-25
References: CVE-2025-58360, URL-https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525

Description:
This module exploits an XML External Entity (XXE) vulnerability in GeoServer
          via the WMS GetMap operation. The vulnerability allows reading arbitrary files
          from the server's file system by injecting an XXE entity in the SLD (Styled Layer Descriptor).

          Affected versions:
          - GeoServer >= 2.26.0, <= 2.26.1
          - GeoServer <= 2.25.5

          The file content is returned in the error message when the layer name contains
          the XXE entity reference.
Metasploit Module: GitLab Authenticated File Read
Type: auxiliary
Path: modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb
Disclosure date: 2023-05-23
References: URL-https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/, URL-https://github.com/Occamsec/CVE-2023-2825, URL-https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/, CVE-2023-2825

Description:
GitLab version 16.0 contains a directory traversal for arbitrary file read
          as the `gitlab-www` user. This module requires authentication for exploitation.
          In order to use this module, a user must be able to create a project and groups.
          When exploiting this vulnerability, there is a direct correlation between the traversal
          depth, and the depth of groups the vulnerable project is in. The minimum for this seems
          to be 5, but up to 11 have also been observed. An example of this, is if the directory
          traversal needs a depth of 11, a group
          and 10 nested child groups, each a sub of the previous, will be created (adding up to 11).
          Visually this looks like:
          Group1->sub1->sub2->sub3->sub4->sub5->sub6->sub7->sub8->sub9->sub10.
          If the depth was 5, a group and 4 nested child groups would be created.
          With all these requirements satisfied a dummy file is uploaded, and the full
          traversal is then executed. Cleanup is performed by deleting the first group which
          cascades to deleting all other objects created.

Check method (fingerprinting):
# check method almost entirely borrowed from gitlab_github_import_rce_cve_2022_2992
    @cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD'])

    raise Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError if @cookie.nil?

    vprint_status('Trying to get the GitLab version')

    version = Rex::Version.new(gitlab_version)

    if version != Rex::Version.new('16.0.0')
      return Exploit::CheckCode::Safe("Detected GitLab version #{version} which is not vulnerable")
    end

    report_vuln(
      host: rhost,
      name: name,
      refs: references,
      info: [version]
    )

    return Exploit::CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.")
  rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError
    return Exploit::CheckCode::Detected('Could not detect the version because authentication failed.')
  rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError => e
    return Exploit::CheckCode::Unknown("#{e.class} - #{e.message}")
  end
Metasploit Module: Apache Superset Signed Cookie Priv Esc
Type: auxiliary
Path: modules/auxiliary/gather/apache_superset_cookie_sig_priv_esc.rb
Disclosure date: 2023-04-25
References: URL-https://github.com/Paradoxis/Flask-Unsign, URL-https://vulcan.io/blog/cve-2023-27524-in-apache-superset-what-you-need-to-know/, URL-https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/, URL-https://github.com/horizon3ai/CVE-2023-27524/blob/main/CVE-2023-27524.py, EDB-51447, CVE-2023-27524

Description:
Apache Superset versions <= 2.0.0 utilize Flask with a known default secret key which is used to sign HTTP cookies.
          These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their user_id to that
          of an administrator, and re-sign the cookie. This valid cookie can then be used to login as the targeted user and retrieve database
          credentials saved in Apache Superset.

Check method (fingerprinting):
res = send_request_cgi!({
      'uri' => normalize_uri(target_uri.path, 'login')
    })
    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Unknown("#{peer} - Unexpected response code (#{res.code})") unless res.code == 200
    return Exploit::CheckCode::Safe("#{peer} - Unexpected response, version_string not detected") unless res.body.include? 'version_string'
    unless res.body =~ /&#34;version_string&#34;: &#34;([\d.]+)&#34;/
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version_string")
    end

    version = Rex::Version.new(Regexp.last_match(1))
    if version < Rex::Version.new('2.0.1') && version >= Rex::Version.new('1.4.1')
      Exploit::CheckCode::Appears("Apache Supset #{version} is vulnerable")
    else
      Exploit::CheckCode::Safe("Apache Supset #{version} is NOT vulnerable")
    end
  end
Metasploit Module: NIS bootparamd Domain Name Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/nis_bootparamd_domain.rb
References: URL-https://datatracker.ietf.org/doc/html/rfc1831, URL-https://datatracker.ietf.org/doc/html/rfc4506, URL-https://pentestmonkey.net/blog/nis-domain-name

Description:
This module discloses the NIS domain name from bootparamd.

          You must know a client address from the target's bootparams file.

          Hint: try hosts within the same network range as the target.
Metasploit Module: Pulse Secure VPN Arbitrary File Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/pulse_secure_file_disclosure.rb
Disclosure date: 2019-04-24
References: CVE-2019-11510, URL-https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/, URL-https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html, URL-https://hackerone.com/reports/591295

Description:
This module exploits a pre-auth directory traversal in the Pulse Secure
          VPN server to dump an arbitrary file. Dumped files are stored in loot.

          If the "Automatic" action is set, plaintext and hashed credentials, as
          well as session IDs, will be dumped. Valid sessions can be hijacked by
          setting the "DSIG" browser cookie to a valid session ID.

          For the "Manual" action, please specify a file to dump via the "FILE"
          option. /etc/passwd will be dumped by default. If the "PRINT" option is
          set, file contents will be printed to the screen, with any unprintable
          characters replaced by a period.

          Please see related module exploit/linux/http/pulse_secure_cmd_exec for
          a post-auth exploit that can leverage the results from this module.
Metasploit Module: MantisBT Admin SQL Injection Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/mantisbt_admin_sqli.rb
Platform: win
Disclosure date: 2014-02-28
References: CVE-2014-2238, URL-https://www.mantisbt.org/bugs/view.php?id=17055

Description:
Versions 1.2.13 through 1.2.16 are vulnerable to a SQL injection attack if
          an attacker can gain access to administrative credentials.

          This vuln was fixed in 1.2.17.
Metasploit Module: HP Operations Manager Perfd Environment Scanner
Type: auxiliary
Path: modules/auxiliary/gather/hp_enum_perfd.rb

Description:
This module will enumerate the process list of a remote machine by abusing
        HP Operation Manager's unauthenticated 'perfd' daemon.
Metasploit Module: Ray static arbitrary file read
Type: auxiliary
Path: modules/auxiliary/gather/ray_lfi_cve_2023_6020.rb
Disclosure date: 2023-11-15
References: CVE-2023-6020, URL-https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6/, URL-https://github.com/protectai/ai-exploits/tree/main/ray

Description:
Ray before 2.8.1 is vulnerable to a local file inclusion.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/version')
    })
    return Exploit::CheckCode::Unknown('No response or unexpected status from Ray API') unless res && res.code == 200

    ray_version = res.get_json_document['ray_version']

    return Exploit::CheckCode::Unknown('Could not determine Ray version') unless ray_version

    return Exploit::CheckCode::Safe("Ray version #{ray_version} is not vulnerable") unless Rex::Version.new(ray_version) <= Rex::Version.new('2.6.3')

    file_content = lfi('/etc/passwd')
    return Exploit::CheckCode::Vulnerable("Ray #{ray_version} - successfully read /etc/passwd") unless file_content.nil?

    Exploit::CheckCode::Appears("Ray version #{ray_version} is in the vulnerable range")
  end
Metasploit Module: Network Shutdown Module sort_values Credential Dumper
Type: auxiliary
Path: modules/auxiliary/gather/eaton_nsm_creds.rb
Disclosure date: 2012-06-26
References: OSVDB-83199, URL-https://web.archive.org/web/[PII_REDACTED]0855/http://secunia.com/advisories/49103/

Description:
This module will extract user credentials from Network Shutdown Module
          versions 3.21 and earlier by exploiting a vulnerability found in
          lib/dbtools.inc, which uses unsanitized user input inside a eval() call.
          Please note that in order to extract credentials, the vulnerable service
          must have at least one USV module (an entry in the "nodes" table in
          mgedb.db).
Metasploit Module: XBMC Web Server Directory Traversal
Type: auxiliary
Path: modules/auxiliary/gather/xbmc_traversal.rb
Disclosure date: 2012-11-04
References: CVE-2012-10024, URL-https://forum.kodi.tv/showthread.php?tid=144110&pid=1227348, URL-https://github.com/xbmc/xbmc/commit/bdff099c024521941cb0956fe01d99ab52a65335, URL-https://ioactive.com/pdfs/Security_Advisory_XBMC.pdf

Description:
This module exploits a directory traversal bug in XBMC 11, up until the
          2012-11-04 nightly build. The module can only be used to retrieve files.
Metasploit Module: Drupal OpenID External Entity Injection
Type: auxiliary
Path: modules/auxiliary/gather/drupal_openid_xxe.rb
Disclosure date: 2012-10-17
References: CVE-2012-4554, OSVDB-86429, BID-56103, URL-https://drupal.org/node/1815912, URL-https://github.com/drupal/drupal/commit/b9127101ffeca819e74a03fa9f5a48d026c562e5, URL-https://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution

Description:
This module abuses an XML External Entity Injection
          vulnerability on the OpenID module from Drupal. The vulnerability exists
          in the parsing of a malformed XRDS file coming from a malicious OpenID
          endpoint. This module has been tested successfully on Drupal 7.15 and
          7.2 with the OpenID module enabled.

Check method (fingerprinting):
signature = Rex::Text.rand_text_alpha(5 + rand(5))
    res = send_openid_auth(signature)

    unless res
      vprint_status("Connection timed out")
      return Exploit::CheckCode::Unknown('Connection timed out')
    end

    if drupal_with_openid?(res, signature)
      return Exploit::CheckCode::Detected('Drupal with OpenID module detected')
    end

    if generated_with_drupal?(res)
      return Exploit::CheckCode::Safe('Drupal detected but OpenID module not found')
    end

    return Exploit::CheckCode::Unknown('Could not determine if target is Drupal')
  end
Metasploit Module: Selenium arbitrary file read
Type: auxiliary
Path: modules/auxiliary/gather/selenium_file_read.rb
Platform: misc
Disclosure date: 2020-10-01
References: URL-https://github.com/JonStratton/selenium-node-takeover-kit
Targets: Native Payload

Description:
If there is an open selenium web driver, a remote attacker can send requests to the victims browser.
          In certain cases this can be used to access to the remote file system.

Check method (fingerprinting):
# Request for Selenium Grid version 4
    v4res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'status')
    })
    if v4res && v4res.get_json_document && v4res.get_json_document.include?('value') &&
       v4res.get_json_document['value'].include?('message')
      if v4res.get_json_document['value']['message'] == 'Selenium Grid ready.'
        return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected and ready.')
      elsif v4res.get_json_document['value']['message'].downcase.include?('selenium grid')
        return Exploit::CheckCode::Unknown('Selenium Grid version 4.x detected but not ready.')
      end
    end

    # Request for Selenium Grid version 3
    v3res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })
    return Exploit::CheckCode::Unknown('Unexpected server reply.') unless v3res&.code == 200

    js_code = v3res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) }
    return Exploit::CheckCode::Unknown('Unable to determine the version.') unless js_code

    json_str = js_code.text.match(/var json = Object.freeze\('(.*?)'\);/)[1]
    begin
      json_data = JSON.parse(json_str)
    rescue JSON::ParserError
      return Exploit::CheckCode::Unknown('Unable to determine the version.')
    end
    return Exploit::CheckCode::Unknown('Unable to determine the version.') unless json_data && json_data.include?
Metasploit Module: Jenkins Domain Credential Recovery
Type: auxiliary
Path: modules/auxiliary/gather/jenkins_cred_recovery.rb
References: EDB-38664, URL-https://www.th3r3p0.com/vulns/jenkins/jenkinsVuln.html

Description:
This module will collect Jenkins domain credentials, and uses
          the script console to decrypt each password if anonymous permission
          is allowed.

          It has been tested against Jenkins version 1.590, 1.633, and 1.638.

Check method (fingerprinting):
version = get_jenkins_version
    vprint_status("Found version: #{version}")

    # Default version is vulnerable, but can be mitigated by refusing anonymous permission on
    # decryption API. So a version wouldn't be adequate to check.
    if version
      return Exploit::CheckCode::Detected('Jenkins detected')
    end

    Exploit::CheckCode::Safe('Target does not appear to be Jenkins')
  end

  # Returns all the found Jenkins accounts of a specific domain. The accounts collected only
  # include the ones with the username-and-password kind. It does not include other kinds such
  # as SSH, certificates, or other plugins.
  #
  # @return [Array<Hash>] An array of account data such as id, username, kind, description, and
  #                       the domain it belongs to.
Metasploit Module: Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal
Type: auxiliary
Path: modules/auxiliary/gather/oats_downloadservlet_traversal.rb
Disclosure date: 2019-04-16
References: CVE-2019-2557, URL-https://srcincite.io/advisories/src-2019-0033/, URL-https://www.oracle.com/security-alerts/cpuapr2019.html

Description:
This module exploits a vulnerability in Oracle Application Testing Suite (OATS). In the Load
          Testing interface, a remote user can abuse the custom report template selector, and cause the
          DownloadServlet class to read any file on the server as SYSTEM. Since the Oracle application
          contains multiple configuration files that include encrypted credentials, and that there are
          public resources for decryption, it is actually possible to gain remote code execution
          by leveraging this directory traversal attack.

          Please note that authentication is required. By default, OATS has two built-in accounts:
          default and administrator. You could try to target those first.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'olt/')
    })

    if res && res.body.include?('AdfLoopbackUtils.runLoopback')
      Exploit::CheckCode::Detected('Oracle ADF Faces endpoint detected')
    else
      Exploit::CheckCode::Safe('Target does not appear to be Oracle ADF Faces')
    end
  end
Metasploit Module: MongoDB NoSQL Collection Enumeration Via Injection
Type: auxiliary
Path: modules/auxiliary/gather/mongodb_js_inject_collection_enum.rb
Platform: linux
Disclosure date: 2014-06-07
Authors: Brandon Perry <bperry.volatile[at]gmail.com>
References: URL-https://nosql.mypopescu.com/post/[PII_REDACTED]/attacking-nosql-and-nodejs-server-side#_=_

Description:
This module can exploit NoSQL injections on MongoDB versions less than 2.4
          and enumerate the collections available in the data via boolean injections.
Metasploit Module: Cisco PVC2300 POE Video Camera configuration download
Type: auxiliary
Path: modules/auxiliary/gather/cisco_pvc2300_download_config.rb
Disclosure date: 2013-07-12
References: URL-https://paper.bobylive.com/Meeting_Papers/BlackHat/USA-2013/US-13-Heffner-Exploiting-Network-Surveillance-Cameras-Like-A-Hollywood-Hacker-Slides.pdf, URL-https://media.blackhat.com/us-13/US-13-Heffner-Exploiting-Network-Surveillance-Cameras-Like-A-Hollywood-Hacker-Slides.pdf, URL-https://www.youtube.com/watch?v=B8DjTcANBx0

Description:
This module exploits an information disclosure vulnerability in Cisco PVC2300 cameras in order
            to download the configuration file containing the admin credentials for the web interface.

            The module first performs a basic check to see if the target is likely Cisco PVC2300. If so, the
            module attempts to obtain a sessionID via an HTTP GET request to the vulnerable /oamp/System.xml
            endpoint using hardcoded credentials.

            If a session ID is obtained, the module uses it in another HTTP GET request to /oamp/System.xml
            with the aim of downloading the configuration file. The configuration file, if obtained, is then
            decoded and saved to the loot directory. Finally, the module attempts to extract the admin
            credentials to the web interface from the decoded configuration file.

            No known solution was made available for this vulnerability and no CVE has been published. It is
            therefore likely that most (if not all) Cisco PVC2300 cameras are affected.

            This module was successfully tested against several Cisco PVC2300 cameras.

Check method (fingerprinting):
res1 = send_request_cgi('uri' => normalize_uri(target_uri.path))

    unless res1
      return Exploit::CheckCode::Unknown('Target is unreachable.')
    end

    # string togetether a few checks to make it more likely we're dealing with a Cisco camera
    unless res1.code == 401 && res1.headers.include?('WWW-Authenticate') && res1.headers['WWW-Authenticate'] == 'Basic realm="IP Camera"'
      return Exploit::CheckCode::Safe('Target is not a Cisco PVC2300 POE Video Camera')
    end

    res2 = send_request_cgi('uri' => normalize_uri(target_uri.path, 'oamp', 'System.xml'))
    unless res2
      return Exploit::CheckCode::Unknown('Target is unreachable.')
    end

    unless res2.code == 200 && res2.body =~ %r{<ActionStatus><statusCode>.*?</statusCode><statusString>.*?</statusString></ActionStatus>}
      return Exploit::CheckCode::Safe('Target is not a Cisco PVC2300 POE Video Camera')
    end

    vprint_status('Target seems to be a Cisco camera')
    Exploit::CheckCode::Appears('Target appears to be a Cisco PVC2300 camera')
  end
Metasploit Module: DarkComet Server Remote File Download Exploit
Type: auxiliary
Path: modules/auxiliary/gather/darkcomet_filedownloader.rb
Platform: win
Disclosure date: 2012-10-08
References: URL-https://www.nccgroup.com/globalassets/our-research/us/whitepapers/PEST-CONTROL.pdf, URL-http://samvartaka.github.io/exploitation/2016/06/03/dead-rats-exploiting-malware

Description:
This module exploits an arbitrary file download vulnerability in the DarkComet C&C server versions 3.2 and up.
          The exploit does not need to know the password chosen for the bot/server communication.
Metasploit Module: FreePBX Custom Extension SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/freepbx_custom_extension_injection.rb
Disclosure date: 2025-12-11
References: CVE-2025-66039, CVE-2025-61675, URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/

Description:
FreePBX versions prior to 16.0.44,16.0.92 and 17.0.23,17.0.6 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61675, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039, while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61675. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a new administrative user.

Check method (fingerprinting):
res = sql_injection(%('))
    if res&.code == 500
      return Exploit::CheckCode::Vulnerable('Detected SQL injection with authentication bypass')
    end

    Exploit::CheckCode::Safe('No SQL injection detected, target is patched')
  end
Metasploit Module: MinIO Bootstrap Verify Information Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/minio_bootstrap_verify_info_disc.rb
Disclosure date: 2023-03-20
References: CVE-2023-28432

Description:
MinIO is a Multi-Cloud Object Storage framework. In a cluster deployment starting with
          RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns
          all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`,
          resulting in information disclosure.

          Verified against MinIO 2023-02-27T18:10:45Z
Metasploit Module: MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/ms14_052_xmldom.rb
Platform: win
Disclosure date: 2014-09-09
References: CVE-2013-7331, MSB-MS14-052, URL-https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/, URL-http://web.archive.org/web/[PII_REDACTED]3555/https://cybersecurity.att.com/blogs/labs-research/attackers-abusing-internet-explorer-to-enumerate-software-and-detect-securi

Description:
This module will use the Microsoft XMLDOM object to enumerate a remote machine's filenames.
          It will try to do so against Internet Explorer 8 and Internet Explorer 9. To use it, you
          must supply your own list of file paths. Each file path should look like this:
          c:\windows\system32\calc.exe
Metasploit Module: ownCloud Phpinfo Reader
Type: auxiliary
Path: modules/auxiliary/gather/owncloud_phpinfo_reader.rb
Disclosure date: 2023-11-21
References: URL-https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/, URL-https://github.com/creacitysec/CVE-2023-49103, URL-https://www.labs.greynoise.io//grimoire/2023-11-29-owncloud-redux/, URL-https://www.rapid7.com/blog/post/2023/12/01/etr-cve-2023-49103-critical-information-disclosure-in-owncloud-graph-api/, CVE-2023-49103

Description:
Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app `graph` installed
          contain a test file which prints `phpinfo()` to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter.
          Docker may export sensitive environment variables including ownCloud, DB, redis, SMTP, and S3 credentials, as well as other host information.