automatic module_metadata_base.json update

Author: jenkins-metasploit

db/modules_metadata_base.json

@@ -69216,6 +69216,66 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457": {
+    "name": "Ivanti Connect Secure Unauthenticated Remote Code Execution via Stack-based Buffer Overflow",
+    "fullname": "exploit/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457",
+    "aliases": [],
+    "rank": 500,
+    "disclosure_date": "2025-04-03",
+    "type": "exploit",
+    "author": [
+      "Stephen Fewer",
+      "Christophe De La Fuente"
+    ],
+    "description": "This module exploits a Stack-based Buffer Overflow vulnerability in\n          Ivanti Connect Secure to achieve remote code execution\n          (CVE-2025-22457). Versions 22.7R2.5 and earlier are vulnerable. Note\n          that Ivanti Pulse Connect Secure, Ivanti Policy Secure and ZTA gateways\n          are also vulnerable but this module doesn't support this software. Heap\n          spray is used to place our payload in memory at a predetermined\n          location. Due to ASLR, the base address of `libdsplibs` is unknown.\n          This library is used by the exploit to build a ROP chain and get\n          command execution. As a result, the module will brute force this\n          address starting from  the address set by the `LIBDSPLIBS_ADDRESS`\n          option.",
+    "references": [
+      "CVE-2025-22457",
+      "URL-https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457",
+      "URL-https://attackerkb.com/topics/0ybGQIkHzR/cve-2025-22457/rapid7-analysis",
+      "URL-https://github.com/sfewer-r7/CVE-2025-22457"
+    ],
+    "platform": "Linux",
+    "arch": "cmd",
+    "rport": 443,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Unix/Linux Command Shell"
+    ],
+    "mod_time": "2025-05-15 12:10:53 +0000",
+    "path": "/modules/exploits/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457.rb",
+    "is_install_path": true,
+    "ref_name": "linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-service-restarts"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_linux/http/ivanti_csa_unauth_rce_cve_2021_44529": {
     "name": "Ivanti Cloud Services Appliance (CSA) Command Injection",
     "fullname": "exploit/linux/http/ivanti_csa_unauth_rce_cve_2021_44529",