3.0.1
3.3.1
3.3.7
CVE-2024-47533 is a critical authentication bypass vulnerability affecting Cobbler versions up to 3.3.6. The flaw allows attackers to connect to the Cobbler XML-RPC interface using empty credentials (username '' and password '-1'), granting them the ability to make arbitrary changes to the system. A patch is available in version 3.3.7, and immediate upgrading is recommended.
This vulnerability poses a significant risk as it allows an attacker to gain complete control over a Cobbler instance without any authentication. Cobbler is often used for automated system provisioning and configuration management, making it a critical component in many IT environments. Successful exploitation could lead to unauthorized modification of system images, deployment of malicious software, and complete compromise of managed systems. The ability to modify system images directly impacts the integrity of the entire infrastructure, potentially leading to widespread compromise. This is akin to gaining root access to the Cobbler server itself.
This vulnerability was publicly disclosed on 2024-11-18. While no active exploitation campaigns have been publicly reported, the ease of exploitation and the critical nature of Cobbler make it a likely target. It is not currently listed on the CISA KEV catalog. Public proof-of-concept code is likely to emerge given the vulnerability's simplicity.
Organizations heavily reliant on Cobbler for automated system provisioning and configuration management are at significant risk. This includes environments with legacy Cobbler deployments or those lacking robust access controls around the XML-RPC interface. Shared hosting environments where Cobbler is used to manage multiple customer systems are particularly vulnerable.
• python / server:
ps aux | grep cobbler• python / server:
journalctl -u cobbler -f | grep "web.ss"• python / server:
find /etc/cobbler/ -name web.ss• python / server:
curl -k -u '':'-1' http://<cobbler_server>/xmlrpcdisclosure
漏洞利用状态
EPSS
67.80% (99% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation is to immediately upgrade Cobbler to version 3.3.7 or later, which contains the fix. If upgrading is not immediately feasible, consider restricting access to the Cobbler XML-RPC interface using a firewall or network segmentation. Implement strict access controls and monitor Cobbler logs for suspicious activity. While not a direct fix, disabling XML-RPC access entirely can reduce the attack surface. After upgrading, verify the fix by attempting to connect to the XML-RPC interface with empty credentials; the connection should be rejected.
升级 Cobbler 到 3.2.3 或更高版本，或 3.3.7 或更高版本。这修复了允许未经授权访问服务器的身份验证漏洞。可以通过 Linux 发行版的包管理器进行升级。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2024-47533 is a critical vulnerability in Cobbler versions up to 3.3.6 that allows attackers to bypass authentication and gain unauthorized access to the XML-RPC interface.
If you are running Cobbler versions 3.3.6 or earlier, you are affected by this vulnerability. Upgrade to version 3.3.7 or later to mitigate the risk.
The recommended fix is to upgrade Cobbler to version 3.3.7 or later. As a temporary workaround, restrict access to the XML-RPC interface using a firewall or network segmentation.
While no active exploitation campaigns have been publicly reported, the ease of exploitation makes it a likely target. Monitor your systems closely.
Refer to the Cobbler project's security advisories for the latest information and updates: https://cobbler.org/security/
上传你的 requirements.txt 文件，立即知道是否受影响。