automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -67993,6 +67993,71 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_linux/http/acronis_cyber_infra_cve_2023_45249": {
+    "name": "Acronis Cyber Infrastructure default password remote code execution",
+    "fullname": "exploit/linux/http/acronis_cyber_infra_cve_2023_45249",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2024-07-24",
+    "type": "exploit",
+    "author": [
+      "h00die-gr3y <[email protected]>",
+      "Acronis International GmbH"
+    ],
+    "description": "Acronis Cyber Infrastructure (ACI) is an IT infrastructure solution that provides storage,\n          compute, and network resources. Businesses and Service Providers are using it for data storage,\n          backup storage, creating and managing virtual machines and software-defined networks, running\n          cloud-native applications in production environments.\n          This module exploits a default password vulnerability in ACI which allow an attacker to access\n          the ACI PostgreSQL database and gain administrative access to the ACI Web Portal.\n          This opens the door for the attacker to upload SSH keys that enables root access\n          to the appliance/server. This attack can be remotely executed over the WAN as long as the\n          PostgreSQL and SSH services are exposed to the outside world.\n          ACI versions 5.0 before build 5.0.1-61, 5.1 before build 5.1.1-71, 5.2 before build 5.2.1-69,\n          5.3 before build 5.3.1-53, and 5.4 before build 5.4.4-132 are vulnerable.",
+    "references": [
+      "CVE-2023-45249",
+      "URL-https://security-advisory.acronis.com/advisories/SEC-6452",
+      "URL-https://attackerkb.com/topics/T2b62daDsL/cve-2023-45249"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "cmd",
+    "rport": 8888,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443,
+      5432
+    ],
+    "autofilter_services": [
+      "http",
+      "https",
+      "postgres"
+    ],
+    "targets": [
+      "Unix/Linux Command",
+      "Interactive SSH"
+    ],
+    "mod_time": "2024-09-26 21:53:27 +0000",
+    "path": "/modules/exploits/linux/http/acronis_cyber_infra_cve_2023_45249.rb",
+    "is_install_path": true,
+    "ref_name": "linux/http/acronis_cyber_infra_cve_2023_45249",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "SideEffects": [
+        "artifacts-on-disk",
+        "ioc-in-logs"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_linux/http/advantech_switch_bash_env_exec": {
     "name": "Advantech Switch Bash Environment Variable Code Injection (Shellshock)",
     "fullname": "exploit/linux/http/advantech_switch_bash_env_exec",