Metabase Pre Authentication RCE (CVE-2023-38646)
We have provided two files:-
- CVE-2023-38646-POC.py for checking if any metabase intance is leaking setup-token.
- CVE-2023-38646-Reverse-Shell.py to get a reerse shell on the attacker controlled machine.
CVE-2023-38646-POC.py
CVE-2023-38646-Reverse-Shell.py
How To Use
git clone https://github.com/securezeron/CVE-2023-38646
cd CVE-2023-38646
pip install -r requirements.txt
python3 CVE-2023-38646-Reverse-Shell.py -h