## New module content (1)
### Metabase Setup Token RCE
Authors: Maxwell Garrett, Shubham Shah, and h00die
**Type:** Exploit
**Pull request:** [#18232]() contributed by [h00die]()
**Path:** `exploits/linux/http/metabase_setup_token_rce`
**AttackerKB reference:** [CVE-2023-38646]()
**Description:** This adds a module for an unauthenticated RCE against Metabase. Metabase versions before 0.46.6.1 contain a bug where an unauthenticated user can retrieve a setup-token. With this, they can query an API endpoint to setup a new database, then inject an H2 connection string RCE.
## Enhanced Modules (1)
Modules which have either been enhanced, or renamed:
* [#18264]() from [zeroSteiner]() – Updates the `exploits/freebsd/http/citrix_formssso_target_rce` module for CVE-2023-3519 to include two new targets, Citrix ADC (NetScaler) 12.1-65.25, and 12.1-64.17. This module now supports automatic targeting based on the `Last-Modified` header of the `logon/fonts/citrix-fonts.css` resource.
## Enhancements and features (6)
* [#18191]() from [jvoisin]() – This adds support for detecting whether a Metasploit session is running in a Podman container and improves detection for sessions running in Docker, LXC, and WLS containers.
* [#18224]() from [rorymckinley]() – This adds the first iteration of specs for SSH Login scanner.
* [#18231]() from [ErikWynter]() – This adds index selection for the modules returned via the favorites (or show favorites) command.
* [#18244]() from [cgranleese-r7]() – Adds tests to ensure the consistency of Metasploit payloads.
* [#18274]() from [wvu]() – Updates CVE-2020-14871 `exploits/solaris/ssh/pam_username_bof` docs.
## Bugs fixed (2)
* [#18220]() from [dwelch-r7]() – Adds additional error handling when loading Metasploit payloads to msfconsole’s startup process to ensure missing payloads do not crash msfconsole.
* [#18260]() from [adfoster-r7]() – This adds a fix to verify the `EC2_ID` module option is validated.
## Documentation
You can find the latest Metasploit documentation on our docsite at [docs.metasploit.com]().
## Get it
As always, you can update to the latest Metasploit Framework with `msfupdate`
and you can get more details on the changes since the last blog post from
GitHub:
* [Pull Requests 6.3.28…6.3.29]()
* [Full diff 6.3.28…6.3.29]()
If you are a `git` user, you can clone the [Metasploit Framework repo]() (master branch) for the latest.
To install fresh without using git, you can use the open-source-only [Nightly Installers]() or the
[binary installers]() (which also include the commercial edition).Read More