Infiltrate the Broadcast! A new module from Chocapikk allows the user to perform remote code execution on vulnerable versions of streaming platform AVideo (12.4 – 14.2). The multi/http/avideo_wwbnindex_unauth_rce module leverages CVE-2024-31819, a vulnerability to PHP Filter Chaining, to gain unauthenticated and unprivileged access, earning it an attacker value of High on AttackerKB. New module content (8) Chaos RAT XSS to RCE Authors: chebuya and h00die Type: Exploit Pull request: #19104 contributed by h00die Path: linux/http/chaos_rat_xss_to_rce AttackerKB reference: CVE-2024-30850 Description: Adds an exploit for HAOS v5.0.8, which contains a remote command execution vulnerability which can be triggered through one of three routes: credentials, JWT token from an agent, an agent executable can be provided, or the JWT token can be extracted. AVideo WWBNIndex Plugin Unauthenticated RCE Author: Valentin Lobstein Type: Exploit Pull request: #19071 contributed by Chocapikk Path: multi/http/avideo_wwbnindex_unauth_rce AttackerKB reference: CVE-2024-31819 Description: Adds a module for CVE-2024-31819 which exploits an LFI in AVideo which uses PHP Filter Chaining to turn the LFI into unauthenticated RCE. NorthStar C2 XSS to Agent RCE Authors: chebuya and h00die Type: Exploit Pull request: #19102 contributed by h00die Path: windows/http/northstar_c2_xss_to_agent_rce AttackerKB reference: CVE-2024-28741 Description: Adds an exploit for CVE-2024-28741 which exploits an XSS…Read More
Metasploit Weekly Wrap-Up 05/23/2024
