.. / CVE-2023-38646

• RCE
• PoC
• Nuclei
• Web
• Hack The Box

Exploit for Metabase < 0.46.6.1 - Unauthenticated Remote Code Execution (CVE-2023-38646)

Description:

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server’s privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Affected Products:

• Metabase < 0.46.6.1

Nuclei Template

View the template here CVE-2023-38646.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-38646.yaml

Try the exploit in a lab environment:

References: