automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -79577,6 +79577,75 @@
     "session_types": false,
     "needs_cleanup": true
   },
+  "exploit_linux/http/paloalto_expedition_rce": {
+    "name": "Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)",
+    "fullname": "exploit/linux/http/paloalto_expedition_rce",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2024-10-09",
+    "type": "exploit",
+    "author": [
+      "Michael Heinzl",
+      "Zach Hanley",
+      "Enrique Castillo",
+      "Brian Hysell"
+    ],
+    "description": "Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below.\n          The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the second vulnerability, CVE-2024-9464, is an authenticated OS command injection. In a default installation, commands will get executed in the context of www-data.\n          When credentials are provided, this module will only exploit the second vulnerability. If no credentials are provided, the module will first try to reset the admin password and then perform the OS command injection.",
+    "references": [
+      "URL-https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/",
+      "URL-https://security.paloaltonetworks.com/PAN-SA-2024-0010",
+      "URL-https://security.paloaltonetworks.com/CVE-2024-5910",
+      "URL-https://attackerkb.com/topics/JwTzQJuBmn/cve-2024-5910",
+      "URL-https://attackerkb.com/topics/ky1MIrne9r/cve-2024-9464",
+      "CVE-2024-5910",
+      "CVE-2024-24809"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "cmd",
+    "rport": 443,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Linux Command"
+    ],
+    "mod_time": "2024-11-12 15:15:15 +0000",
+    "path": "/modules/exploits/linux/http/paloalto_expedition_rce.rb",
+    "is_install_path": true,
+    "ref_name": "linux/http/paloalto_expedition_rce",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs",
+        "artifacts-on-disk",
+        "account-lockouts"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": true
+  },
   "exploit_linux/http/pandora_fms_events_exec": {
     "name": "Pandora FMS Events Remote Command Execution",
     "fullname": "exploit/linux/http/pandora_fms_events_exec",