Description
This module exploits an unauthenticated remote code execution vulnerability in MajorDoMo's saverestore module via supply chain poisoning. The saverestore module's admin() method is reachable without authentication through the /objects/?module=saverestore endpoint because usual() calls admin() directly and uses gr() (which reads from $_REQUEST) instead of $this->mode for mode checks.
Two unauthenticated GET requests chain together for full RCE: 1. auto_update_settings - poisons the MASTER_UPDATE_URL to point to an attacker-controlled server 2. force_update - triggers autoUpdateSystem() which fetches an Atom feed and tarball from the poisoned URL, extracts the tarball, and copies all files to the webroot via copyTree()
The tarball is downloaded via curl with CURLOPT_SSL_VERIFYPEER set to FALSE and no integrity check. The attacker serves a fake Atom feed with an entry older than the configured delay (default 1 day) and a tarball containing a PHP webshell. After deployment, the module executes the payload through the webshell.
All versions of MajorDoMo up to and including the latest release are affected. The fix is tracked in PR sergejey/majordomo#1177.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/majordomo/supply_chain_rcemsf undefined(supply_chain_rce) > show actions ...actions...msf undefined(supply_chain_rce) > set ACTION < action-name >msf undefined(supply_chain_rce) > show options ...show and set options...msf undefined(supply_chain_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub