CVE-2024-50603 PoC — Aviatrix Controller 操作系统命令注入漏洞

Source

https://github.com/th3gokul/CVE-2024-50603

Associated Vulnerability

Title:Aviatrix Controller 操作系统命令注入漏洞 (CVE-2024-50603)
Description:An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Description

CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection

Readme

# CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection

CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-50603 with Asychronous Performance.

<h1 align="center">
  <img src="https://github.com/user-attachments/assets/6f360b42-bd54-4e88-a4fd-aca25ffa9d7a" width="2000px">
  <br>
</h1>


### Installation

```bash
git clone https://github.com/th3gokul/CVE-2024-50603.git
cd CVE-2024-50603
pip install -r requirements.txt
python3 cvehunter.py --help@RevoltSecurities
```

```bash
python3 cvehunter.py -h

 ▄████▄ ██▒   █▓▓█████  ██░ ██  █    ██  ███▄    █ ▄▄▄█████▓▓█████  ██▀███  
▒██▀ ▀█▓██░   █▒▓█   ▀ ▓██░ ██▒ ██  ▓██▒ ██ ▀█   █ ▓  ██▒ ▓▒▓█   ▀ ▓██ ▒ ██▒
▒▓█    ▄▓██  █▒░▒███   ▒██▀▀██░▓██  ▒██░▓██  ▀█ ██▒▒ ▓██░ ▒░▒███   ▓██ ░▄█ ▒
▒▓▓▄ ▄██▒▒██ █░░▒▓█  ▄ ░▓█ ░██ ▓▓█  ░██░▓██▒  ▐▌██▒░ ▓██▓ ░ ▒▓█  ▄ ▒██▀▀█▄  
▒ ▓███▀ ░ ▒▀█░  ░▒████▒░▓█▒░██▓▒▒█████▓ ▒██░   ▓██░  ▒██▒ ░ ░▒████▒░██▓ ▒██▒
░ ░▒ ▒  ░ ░ ▐░  ░░ ▒░ ░ ▒ ░░▒░▒░▒▓▒ ▒ ▒ ░ ▒░   ▒ ▒   ▒ ░░   ░░ ▒░ ░░ ▒▓ ░▒▓░
  ░  ▒    ░ ░░   ░ ░  ░ ▒ ░▒░ ░░░▒░ ░ ░ ░ ░░   ░ ▒░    ░     ░ ░  ░  ░▒ ░ ▒░
░           ░░     ░    ░  ░░ ░ ░░░ ░ ░    ░   ░ ░   ░         ░     ░░   ░ 
░ ░          ░     ░  ░ ░  ░  ░   ░              ░             ░  ░   ░     
░           ░                                                               
   CVE-2024-50603                      @th3gokul & @th3sanjai

[Description]: Vulnerability Detection and Exploitation tool for CVE-2024-34102

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     [INF]: Specify a URL or domain for vulnerability detection
  -l LIST, --list LIST  [INF]: Specify a list of URLs for vulnerability detection
  -t THREADS, --threads THREADS
                        [INF]: Number of threads for list of URLs
  -proxy PROXY, --proxy PROXY
                        [INF]: Proxy URL to send request via your proxy
  -v, --verbose         [INF]: Increases verbosity of output in console
  -o OUTPUT, --output OUTPUT
                        [INF]: Filename to save output of vulnerable target]
```

### Reference
https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/

### About:

The CVEHunter tool is an exploitation tool for CVE-2024-34102 and the Devlopers of the tool are
   - [Th3Gokul @RevoltSecurities](https://www.linkedin.com/in/gokul-v-13455521a/)
   - [Th3sanjai @RevoltSecurities](https://www.linkedin.com/in/d-sanjai-kumar-109a7227b/)

and We specially Thank [bebik](https://github.com/bebiksior) and his [SSRF](ssrf.cvssadvisor.com/) tool which helped in our research and exploitation 
on CVE-2024-50603 to know the callbacks, pings and find accurate results while exploiting this vulnerability, We appreciate him for the great contribution for Open Source Community.


### Disclaimer
The tool ⚒️ is only for education 📖 and ethical purpose only and Developers are not responsible for any illegal exploitations.

File Snapshot


 [4.0K]  /data/pocs/e70e0325017cadb4cdf4caefa845d0671e7ecfd7
├── [ 12K]  cvehunter.py
└── [3.6K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!