CVE-2024-47533 Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
Attackers can bypass authentication on Cobbler XML-RPC using hardcoded credentials to gain full control and modify server configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47533?
CVE-2024-47533 is a critical authentication bypass vulnerability in cobbler, published on 18 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
Weakness: CWE-287
Which versions are affected by CVE-2024-47533?
5 open source packages ship an affected version, including cobbler.
| Package | Affected | Fixed in |
|---|---|---|
cobbler PyPI | From 3.0.0 | 3.2.3, 3.3.7 |
cobbler PyPI | From 3.0.0 | 3.2.3 |
cobbler PyPI | From 3.0.0 | 3.2.3 |
cobbler PyPI | From 3.3.0 | 3.3.7 |
cobbler PyPI | From 3.3.0 | 3.3.7 |
Linux distribution packages (5)
cobbler SUSE:Package Hub 15 SP5 | All versions | 3.3.7-bp155.2.3.2 |
cobbler SUSE:Package Hub 15 SP6 | All versions | 3.3.7-bp156.2.6.1 |
cobbler openSUSE:Leap 15.5 | All versions | 3.3.7-bp155.2.3.2 |
cobbler openSUSE:Leap 15.6 | All versions | 3.3.7-bp156.2.6.1 |
cobbler openSUSE:Tumbleweed | All versions | 3.3.7-1.1 |
How do I fix CVE-2024-47533?
Upgrade cobbler to a fixed version for your release line: 3.2.3 or 3.3.7.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-47533 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47533 exists.
Public exploit code: 1 Nuclei template and 5 proofs of concept on GitHub.
Sources
Also known as GHSA-m26c-fcgh-cp6h, OESA-2025-1411, OESA-2025-1412, OESA-2025-1413, OESA-2025-1414, OESA-2025-1435 and 4 more.