module

OpenNMS Horizon Authenticated RCE

Try Surface Command
Back to search
Disclosed
Jul 1, 2023
Created
Mar 21, 2024

Description

This module exploits built-in functionality in OpenNMS
Horizon in order to execute arbitrary commands as the
opennms user. For versions 32.0.2 and higher, this
module requires valid credentials for a user with
ROLE_FILESYSTEM_EDITOR privileges and either
ROLE_ADMIN or ROLE_REST.

For versions 32.0.1 and lower, credentials are
required for a user with ROLE_FILESYSTEM_EDITOR,
ROLE_REST, and/or ROLE_ADMIN privileges. In that case,
the module will automatically escalate privileges via
CVE-2023-40315 or CVE-2023-0872 if necessary.

This module has been successfully tested against OpenNMS
version 31.0.7

Author

Erik Wynter

Platform

Linux

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/http/opennms_horizon_authenticated_rce
    msf exploit(opennms_horizon_authenticated_rce) > show targets
        ...targets...
    msf exploit(opennms_horizon_authenticated_rce) > set TARGET < target-id >
    msf exploit(opennms_horizon_authenticated_rce) > show options
        ...show and set options...
    msf exploit(opennms_horizon_authenticated_rce) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today