Sploitus

Exploit for CVE-2021-41277

kitploit · 2026-09-02

Exploit Code

MARKDOWN64 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ZER0YU-CVE-2021-41277
# CVE-2021-41277

## Использование

### 1\. Показать справку

root@kitploit:~
    
    
    ~/CVE-2021-41277
    ❯ go run main.go -h                     
    Usage of main:
      -f string
            File containing list of targets to verfity
      -o string
            File to write output to (optional)
      -s    Show VulnInfo output
      -t int
            Number of concurrent goroutines for resolving (default 10)
      -u string
            Target to verfity CVE-2021-41277
      -v    Show Verbose output
    

### 2\. Показать информацию об уязвимости

root@kitploit:~
    
    
    ~/CVE-2021-41277
    ❯ go run main.go -s 
    [INF] VulnInfo:
    {
      "Name": "Metabase sensitive information leakage",
      "VulID": "CVE-2021-41277",
      "Version": "1.0",
      "Author": "z3",
      "VulDate": "2021-11-20",
      "References": [
        "https://nosec.org/home/detail/4909.html",
        "https://www.freebuf.com/vuls/306858.html"
      ],
      "AppName": "metabase",
      "AppPowerLink": "https://www.metabase.com/",
      "AppVersion": "metabase version \u003c 0.40.5 and metabase version \u003e= 1.0.0, \u003c 1.40.5",
      "VulType": "INFORMATION DISCLOSURE",
      "Description": "Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin-\u003esettings-\u003emaps-\u003ecustom maps-\u003eadd a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you\u0026#8217;re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.",
      "Category": "REMOTE",
      "Dork": {
        "Fofa": "app=\"metabase\"",
        "Quake": "",
        "Zoomeye": "",
        "Shodan": ""
      }
    }%  
    

### 3\. Выполнить обнаружение

root@kitploit:~
    
    
    cat test.txt | go run main.go -t 20 -v